BILL ANALYSIS                                                                                                                                                                                                    Ó






           ----------------------------------------------------------------- 
          |SENATE RULES COMMITTEE            |                       AB 1580|
          |Office of Senate Floor Analyses   |                              |
          |(916) 651-1520    Fax: (916)      |                              |
          |327-4478                          |                              |
           ----------------------------------------------------------------- 


                                   THIRD READING 


          Bill No:  AB 1580
          Author:   Gatto (D) and Irwin (D), et al.
          Amended:  6/21/16 in Senate
          Vote:     21 

           SENATE JUDICIARY COMMITTEE:  7-0, 6/14/16
           AYES:  Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning,  
            Wieckowski

           ASSEMBLY FLOOR:  78-0, 5/12/16 (Consent) - See last page for  
            vote

           SUBJECT:   Consumer credit reports:  security freezes:   
                     protected consumer


          SOURCE:    Author   


          DIGEST:  This bill requires a consumer credit reporting agency  
          to place a security freeze on the credit file of a protected  
          consumer upon the request of, and submission of specified  
          information by, the protected consumer's representative, as  
          specified.  This bill defines a protected consumer as any of the  
          following: an individual who is under 16 years of age at the  
          time a request for the placement of a security freeze is made;  
          an incapacitated person or a protected individual for whom a  
          guardian or conservator has been appointed; or a person under  
          the jurisdiction of a county welfare department or county  
          probation department who has been placed in a foster care  
          setting and is under 16 years of age at the time a request for a  
          security freeze is made.  









                                                                    AB 1580  
                                                                    Page  2



          ANALYSIS:  


          Existing law:


           1) Requires consumer credit reporting agencies to adopt  
             reasonable procedures for meeting the needs of commerce for  
             consumer credit, personnel, insurance, hiring of a dwelling  
             unit, and other information in a manner which is fair and  
             equitable to the consumer, with regard to the  
             confidentiality, accuracy, relevancy, and proper utilization  
             of such information.  (California Consumer Credit Reporting  
             Agencies Act, Civ. Code Sec. 1785.1(d); Federal Fair Credit  
             Reporting Act 15 U.S.C. Sec. 1681(b).)


           2) Permits a consumer to place a "security freeze" on his or  
             her credit report, prohibiting consumer credit reporting  
             agencies from releasing the consumer's credit report or any  
             information contained in it unless the consumer expressly  
             authorizes the release.  (Civ. Code Sec. 1785.11.2(a).)


           3) Requires a credit reporting agency to place a security  
             freeze on a consumer's credit report within three business  
             days after receiving the consumer's request.  (Civ. Code Sec.  
             1785.11.2(b).)


           4) Requires a credit reporting agency to send a written  
             confirmation of the security freeze to the consumer within 10  
             business days.  The credit reporting agency must also provide  
             the consumer with a unique personal identification number or  
             password to be used by the consumer when he or she authorizes  
             the release of his or her information for a specific party or  
             period of time.  (Civ. Code Sec. 1785.11.2(c).)


           5) Permits a consumer to allow his or her credit report to be  
             accessed for a specific party or period of time while a  
             freeze is in place and requires the consumer to provide  
             specified information to the credit reporting agency so that  







                                                                    AB 1580  
                                                                    Page  3


             the freeze may be temporarily lifted.  (Civ. Code Sec.  
             1785.11.2(d).)


           6) Requires a credit reporting agency that receives a  
             consumer's request to temporarily lift a freeze to comply  
             with that request within three business days.  (Civ. Code  
             Sec. 1785.11.2(e).)


           7) Provides that a credit reporting agency may remove or  
             temporarily lift a freeze only upon the consumer's request or  
             if the consumer's credit report was frozen due to a material  
             misrepresentation of fact by the consumer, in which case the  
             credit reporting agency must notify the consumer before  
             removing the freeze.  (Civ. Code Sec. 1785.11.2(g).)


           8) Requires that a security freeze must remain in place until  
             the consumer requests that it be removed.  If a consumer  
             requests that the freeze be removed and provides specified  
             information, a credit reporting agency must comply with that  
             request within three business days of receiving the request  
             for removal.  (Civ. Code Sec. 1785.11.2(j).)  Existing law  
             provides that a credit reporting agency must require proper  
             identification, as defined, of a consumer making a request to  
             place or remove a security freeze.  (Civ. Code Sec.  
             1785.11.2(k).)


          This bill:


           1) Requires a consumer credit reporting agency to place a  
             security freeze on the credit file or record of a protected  
             consumer if the agency receives both a request from the  
             protected consumer's representative for the placement of the  
             freeze, and specified information showing proof of identity  
             and authority to act on behalf of the protected consumer.


           2) Requires a consumer credit reporting agency to create a  
             record for a protected consumer when it receives a request  
             for the placement of a security freeze if the agency does not  







                                                                    AB 1580  
                                                                    Page  4


             have a credit file pertaining to the protected consumer.


           3) Specifies that within 30 days after receiving a request, a  
             consumer credit reporting agency shall place a security  
             freeze for the protected consumer.  The consumer credit  
             reporting agency must send written confirmation of the  
             security freeze to the protected consumer's address on file  
             within 10 days of the placement of the security freeze.


           4) Specifies that unless a security freeze for a protected  
             consumer is removed, a consumer credit reporting agency shall  
             not release the protected consumer's credit report, any  
             information derived from the protected consumer's credit  
             report, or any record created for the protected consumer.


           5) States that in order to remove a security freeze, a  
             protected consumer or a protected consumer's representative  
             must submit a request for removal of the security freeze to  
             the consumer credit reporting agency and provide specified  
             information showing proof of identity and authority to act on  
             behalf of the protected consumer.


           6) States that a consumer credit reporting agency shall remove  
             a security freeze for a protected consumer within 30 days  
             after receiving both the request to remove the freeze and all  
             required information.


           7) Specifies that except as provided, a consumer credit  
             reporting agency is authorized to charge a reasonable fee,  
             not exceeding $10, for each placement or removal of a  
             security freeze for a protected consumer.


           8) Excludes certain entities from the above restrictions,  
             including, among others, a person administering a credit file  
             monitoring subscription service to which the representative  
             of the protected consumer has subscribed on behalf of the  
             protected consumer.








                                                                    AB 1580  
                                                                    Page  5



           9) Defines a "protected consumer" as an individual who is any  
             of the following:


              a)    Under 16 years of age at the time a request for the  
                placement of a security freeze is made;


              b)    An incapacitated person or a protected person for whom  
                a guardian or conservator has been appointed; or


              c)    Under the jurisdiction of a county welfare department  
                or county probation department, has been placed in a  
                foster care setting, and is under 16 years of age at the  
                time a request for placement of a security freeze is made.


           10)Defines a "representative" as a person who provides to a  
             consumer credit reporting agency sufficient proof of  
             authority to act on behalf of a protected consumer.  This  
             bill specifies that for a protected consumer who has been  
             placed in a foster care setting, "representative" means  
             either a county welfare department or its agent or designee,  
             or a county probation department or its agent or designee,  
             but that it does not mean the foster parent of a protected  
             consumer who has been placed in a foster care setting.


          Background


          According to the Federal Trade Commission's (FTC) "Consumer  
          Sentinel Network Data Book for January - December 2015,"  
          California had more identity theft complaints-55,305-than any  
          other state.  For every 100,000 people in California, there were  
          141.3 identity theft complaints.  Nationwide, identity theft has  
          increased more than five-fold during the past 15 years, with the  
          FTC receiving almost a half-million complaints from consumers in  
          2015 alone.  (FTC, Consumer Sentinel Network Data Book for  
          January - December 2015 (Feb. 2016)  
           
                                                                    Page  6


          ember-2015/160229csn-2015databook.pdf  [as of June 1, 2016].)


          Identity theft victims' information can be misused in numerous  
          ways.  One of the most common is the creation of new accounts,  
          including credit card, utility, or wireless telephone accounts.   
          But, victims' information can also be used in other, equally  
          nefarious ways.  As the FTC notes:


            Once identity thieves have your personal information, they can  
            drain your bank account, run up charges on your credit cards,  
            open new utility accounts, or get medical treatment on your  
            health insurance.  An identity thief might even file a tax  
            return in your name and get your refund.  In some extreme  
            cases, a thief might even give your name to the police during  
            an arrest.  (Federal Trade Commission, Taking Charge: What To  
            Do If Your Identity Is Stolen (Apr. 2013)  
             
                                                                    Page  7


          Chapter 720, Statutes of 2001].)  Freezes placed on credit  
          reports can be a useful tool in frustrating the ability of  
          identity thieves to open new lines of credit using another  
          person's stolen identity.  Since that time, at least 46 other  
          states have followed California's lead and enacted security  
          freeze legislation, limiting disclosure of consumers' credit  
          reports.  Under current law, security freezes are available to  
          any consumer with a credit report, but individuals who have  
          never had credit in their names, such as children, may not have  
          a credit report on file for which a freeze could be placed.


          This bill requires a consumer credit reporting agency to place a  
          security freeze on the credit file of a protected consumer,  
          including children under the age of 16, upon the request of, and  
          submission of specified information by, the protected consumer's  
          representative.


          Comments


          According to the author:


            Credit freezing is one of the best tools available to prevent  
            identity theft.  Under current law, credit bureaus are not  
            mandated to, and therefore do not, offer a clear path to  
            freeze a child's credit record unless the child has already  
            had his or her credit stolen.  Otherwise, the parent must go  
            through an onerous process to add the child as an authorized  
            user on an existing credit card, which includes a 60 to 90 day  
            wait period, provision of notarized identification documents  
            to credit bureaus, and a confirmation notice.  Similar  
            barriers prevented adults from freezing their own credit  
            reports until new regulations made the process secure and  
            easy.


            According to a Carnegie Mellon study, children are 50 times  
            more likely than adults to have their identities stolen.   
            Child identities are valuable to thieves because children do  
            not have existing credit files, and parents may not notice  
            fraudulent activity until the child applies for a student  







                                                                    AB 1580  
                                                                    Page  8


            loan, a job, or a credit card.  Recent security breaches at  
            Anthem and Premera Blue Cross highlight the fact that  
            technological advances make identity theft much easier.  In  
            these breaches alone, hackers stole an estimated 19 million  
            records including names, birth dates, and social security  
            numbers, many belonging to children.


            AB 1580 will allow a parent, legal guardian or conservator to  
            put a credit freeze in place for a child under the age of 16,  
            or for an incapacitated individual.  To place the freeze, a  
            parent or representative would directly contact the credit  
            bureau and submit the request for a credit freeze in a secure  
            manner.  Representatives would authenticate their identity and  
            prove they can legally act on behalf of the child or  
            individual.  After the request is filed, a protected consumer  
            record will be created, and credit will be frozen within 30  
            days.  A credit bureau will then be prohibited from releasing  
            credit information or customer records for that protected  
            child or individual.


          Related/Prior Legislation


          AB 1723 (Dodd, 2016), among other things, specifies that a debt  
          collector shall initiate review of an account within 10 business  
          days of receiving specified information that a consumer has  
          become the victim of identity theft and that the debt being  
          collected is not the responsibility of the consumer.  The bill  
          additionally requires the debt collector to notify, within 10  
          business days, any consumer credit reporting agency to which the  
          debt collector furnished adverse information pertaining to a  
          creditor's account that the account is disputed, and requires  
          the debt collector to send notice of its determination to the  
          debtor no later than 10 business days after concluding the  
          review.  The bill is pending in the Senate Judiciary Committee.


          SB 641 (Wieckowski, Chapter 804, Statutes of 2015) added a  
          provision to the Fair Debt Buying Practices Act to provide  
          consumers, in limited circumstances involving actions brought by  
          debt buyers, extended time to file a motion to set aside a  
          default or default judgment and for leave to defend an action  







                                                                    AB 1580  
                                                                    Page  9


          relating to debt, if the service of summons did not result in  
          actual notice to the consumer in time to defend the action.


          AB 2374 (Hernandez, Chapter 645, Statutes of 2012) prohibited  
          credit reporting agencies from charging specified consumers any  
          fee for the initial placement of a security freeze, but  
          authorized such agencies to charge a fee of up to $5 for  
          lifting, removing, or replacing a security freeze.


          AB 372 (Salas, Chapter 151, Statutes of 2008) permitted a credit  
          reporting agency to charge a fee of no more than $5 to a  
          consumer 65 years of age or older and no more than $10 to other  
          consumers for a request for a security freeze, removal of the  
          freeze, or temporary lifting of the freeze for a period of time  
          or for a specific party.


          AB 2043 (Banking and Finance Committee, Chapter 521, Statutes of  
          2006) authorized specified business entities that become the  
          victims of identity theft to utilize debt relief protections  
          available to natural persons who are victimized by identity  
          theft.


          AB 1294 (Wiggins, Chapter 287, Statutes of 2003) required a debt  
          collector to stop collecting a consumer's debt if an alleged  
          debtor provides the collector with specified information showing  
          that the debtor is a victim of identity theft, as specified.


          SB 168 (Bowen, Chapter 720, Statutes of 2001) gave California  
          consumers the right to place a freeze on their credit reports,  
          which, while in place, prohibits a credit reporting agency from  
          releasing the consumer's credit report without the express  
          authorization of the consumer.


          AB 156 (Murray, Chapter 768, Statutes of 1997) formally  
          recognized identity theft as a crime, providing that it is a  
          misdemeanor for a person to willfully obtain personal  
          identifying information of another and use that information to  
          obtain, or attempt to obtain, credit, goods, or services in the  







                                                                    AB 1580  
                                                                    Page  10


          name of another person without the consent of that person.




          FISCAL EFFECT:   Appropriation:    No          Fiscal  
          Com.:NoLocal:    No


          SUPPORT:   (Verified6/14/16)


          California Attorney General Kamala Harris
          AARP California
          California District Attorneys Association
          California Public Interest Research Group
          Common Sense Kids Action
          Consumer Attorneys of California
          National Association of Social Workers, California Chapter
          Privacy Rights Clearinghouse
          Professional Fiduciary Association of California
          Sacramento County District Attorney
          Ventura County Sheriff's Office




          OPPOSITION:   (Verified6/14/16)


          None received


          ASSEMBLY FLOOR:  78-0, 5/12/16
          AYES:  Achadjian, Alejo, Travis Allen, Arambula, Atkins, Baker,  
            Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Calderon,  
            Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper,  
            Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines,  
            Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson,  
            Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger  
            Hernández, Holden, Irwin, Jones, Kim, Lackey, Levine, Linder,  
            Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina,  
            Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen,  
            Patterson, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago,  







                                                                    AB 1580  
                                                                    Page  11


            Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber,  
            Wilk, Williams, Wood, Rendon
          NO VOTE RECORDED:  Burke, Jones-Sawyer

          Prepared by:Tobias Halvarson / JUD. / (916) 651-4113
          6/22/16 15:14:51


                                   ****  END  ****