BILL ANALYSIS                                                                                                                                                                                                    

                                                                    AB 1580

                                                                    Page  1


          1580 (Gatto and Irwin)

          As Amended  June 21, 2016

          Majority vote

          |ASSEMBLY:  |78-0  |(May 12, 2016) |SENATE: |38-0  |(August 18,      |
          |           |      |               |        |      |2016)            |
          |           |      |               |        |      |                 |
          |           |      |               |        |      |                 |

          Original Committee Reference:  B. & F.

          SUMMARY:  Permits a parent or other legal representative to  
          freeze a child's credit records with the three major consumer  
          credit reporting agencies (CCRAs), and requires a CCRA to create  
          a record for the protected consumer and impose a security freeze  
          within 30 days of receiving a request if a file for that person  
          does not already exist.  Specifically, this bill:  

          1)Requires a CCRA to disclose the process for placing and  
            removing a security freeze, and to place a security freeze on  
            an account if the protected consumer's representative: 

             a)   Submits a request to the CCRA at the address or other  
               point of contact and in the manner specified by the CCRA;

             b)   Provides sufficient proof of identification; 


                                                                    AB 1580

                                                                    Page  2

             c)   Provides sufficient proof of authority to act on behalf  
               of the protected consumer; and

             d)   Pays the CCRA the requisite fee. 

          2)Requires a CCRA, if it does not have a file on the protected  
            consumer, to create a record for the protected consumer and to  
            place the security freeze within 30 days of receiving a  
            request and to send written confirmation of freeze to within  
            10 days of placing the freeze.

          3)Prohibits the CCRA from releasing information from a protected  
            consumer's frozen report or record until the protected  
            consumer (or representative) either removes the freeze or the  
            CCRA removes the freeze because of a material  
            misrepresentation of fact.

          4)Requires that in order to remove a freeze, the protected  
            consumer (or representative) must submit a request for removal  
            to the CCRA, as specified by the CCRA and meet the same  
            requirements specified above for placing a freeze and allows a  
            consumer to act for him- or herself upon presenting proof of  
            emancipation or that he or she is at least 16 years old. 

          5)Allows CCRAs to charge a $10 fee for placing or removing a  
            security freeze, unless the protected consumer is a documented  
            identity theft victim, the protected consumer is under 16 and  
            the CCRA has an existing record on the protected consumer at  
            the time of the request, or the request is for a foster child.

          6)Allows a CCRA to develop procedures for submitting requests  
            for placement or removal of a freeze by phone, mail, fax, the  
            Internet or other electronic media.


                                                                    AB 1580

                                                                    Page  3

          7)Exempts from the security freeze (i.e., permits access to  
            "frozen" records for) the following:  

             a)   Banks and other lenders who access a consumer's credit  
               report only for the purpose of reviewing existing accounts  
               the consumer has with the bank or lender.

             b)   Resellers of credit report information.

             c)   Check services or fraud prevention services that issue  
               check fraud and exchange traded fund (ETF) fraud reports;  
               and deposit account information services that issue reports  
               on account closures due to fraud, substantial overdrafts,  
               automated teller machine (ATM) abuse, or similar negative  
               information for use by banks who are reviewing existing  
               consumer accounts.

             d)   Credit monitoring services when the protected consumer  
               (or the representatives) has subscribed to the services.

             e)   The protected consumer himself or herself (or the  
               representative) upon request.

             f)   Any state or local agency, law enforcement agency, trial  
               court, or private collection agency acting pursuant to a  
               court order, warrant, or subpoena.

             g)   A child support agency acting under state or federal law  
               to collect child support.

             h)   The Department of Health Care Services acting to  
               investigate Medi-Cal fraud.


                                                                    AB 1580

                                                                    Page  4

             i)   The Franchise Tax Board acting to investigate or collect  
               delinquent taxes, unpaid court orders, or to fulfill its  
               other statutory responsibilities.

          8)Defines the following terms:

             a)   "Protected consumer" means an individual who is under  
               16, incapacitated, or under a county welfare or county  
               probation department's jurisdiction;

             b)   "Record" means information that identifies a protected  
               consumer and that is created by a CCRA for this bill and  
               not for credit decision-making;

             c)   "Representative" means a person who provides sufficient  
               proof of authority to act for a protected person, as  
               specified, and would include a county welfare or probation  
               department for a child in foster care, but would not  
               include a foster parent;

             d)   "Security freeze" means a restriction that a CCRA places  
               on a protected consumer's record or file that prohibits the  
               CCRA from releasing a any report or information about a  
               protected consumer, except as authorized by the bill. 

             e)   "Sufficient proof of authority" means documentation that  
               shows a representative has authority to act for a protected  
               consumer, including:  a court order, a valid power of  
               attorney, a written, notarized statement, or in the case of  
               a foster child a written communication from a county  
               welfare or probation department specifying that the  
               protected consumer is under the department's jurisdiction;

             f)   "Sufficient proof of identification" means documentation  


                                                                    AB 1580

                                                                    Page  5

               that identifies a protected consumer or a representative,  
               including:  a social security number or card; a certified  
               or official copy of a birth certificate; a copy of a  
               California driver's license or identification card or other  
               government-issued identification; a copy of a utility bill  
               that shows name and address, or in the case of a foster  
               child a written communication from a county welfare or  
               probation department certifying that the protected consumer  
               is under the department's jurisdiction.

          The Senate amendments make technical and clarifying changes.

          EXISTING LAW:  

          1)Regulates CCRAs via the Consumer Credit Reporting Agencies  
            Act.  [Civil Code, Section 1785.1 et seq.  All further  
            references are to the Civil Code]
          2)Allows a CCRA to charge a consumer who is 65 years of age or  
            older and who has provided identification confirming his or  
            her age a fee not to exceed $5 for placement of each freeze,  
            the removal of the freeze, the temporary lift of the freeze  
            for a period of time, or the temporary lift of the freeze for  
            a specific party.  [Section 1785.11.2 (m)]

          3)Allows a consumer to place a security freeze on his or her  
            credit report by making a written request by mail to a CCRA.    
            [Section 1785.11.2(a)]

          4)Defines "security freeze" as a notice placed in a consumer's  
            credit report at the consumer's request and, subject to  
            certain exceptions, prohibits the credit reporting agency from  
            releasing the credit report or any information from it without  
            the consumer's express authorization.  [Section 1785.11.2]

          5)Requires the CCRA to place a security freeze on the consumer's  
            credit report no later than 3 days after receiving a request,  


                                                                    AB 1580

                                                                    Page  6

            and within 10 business days must send the consumer written  
            confirmation of the freeze along with a unique personal  
            identification or password to be used by the consumer when  
            authorizing the release of his or her credit for a specific  
            party or period of time.  [Section 1785.11.2(b) (c)].

          6)Allows a consumer to request a temporary lift of a security  
            freeze, if certain conditions are met.  A CCRA that receives a  
            request for a temporary lift of a security freeze is required  
            to do so within three business days of receiving the request.   
            [Section 1785.11.2(d) (e) (g)]

          7)Provides that a CCRA may develop procedures involving the use  
            of telephone, fax, the internet, or other electronic media to  
            receive and process a consumer request to temporarily lift a  
            security freeze in an expedited manner.  [Section  

          8)Requires that, if a consumer requests a security freeze, the  
            CCRA must inform the consumer of the process for placing and  
            temporarily lifting a freeze, and the process for allowing  
            access to information from the consumer's credit report for a  
            specific party or period of time while a freeze is in place.   
            [Section 1785.11.2(i)]

          9)Allows, except as specified, a CCRA to charge a fee of no more  
            than $10 to a consumer for each freeze, removal of the freeze,  
            or temporary lift of the freeze for a period of time.   
            [Section 1785.11.2(m)]

          10)Prohibits a fee from being charged to place a security freeze  
            for a victim of identity theft who presents a valid police  
            report or valid Department of Motor Vehicles (DMV)  
            investigative report [Section 1785.11.2(m)]

          11)Requires that whenever a CCRA provides a written disclosure  


                                                                    AB 1580

                                                                    Page  7

            to a consumer that it must also include a notice to a consumer  
            of their rights to receive and correct errors on their credit  
            report, as well as, information on placing a security freeze  
            and credit alert on their credit file. [Section 1785.15]

          EXISTING FEDERAL LAW requires every credit reporting agency to  
          disclose to a consumer, upon request, specific information  
          related to that consumer's credit report, as well as, directions  
          on how to contest information contained within the report.   
          [Fair Credit Reporting Act 15 United States Code (U.S.C.) 1681et  

          FISCAL EFFECT:  None.

          COMMENTS:  Need for the bill:

          According to the Authors:  

            "Most children get a Social Security Number early in their  
            lives.  Identity thieves recognize this and recognize that  
            parents are not monitoring their child's credit.  For that  
            reason, thieves are targeting children, stealing their  
            identity, and opening credit lines with their Social  
            Security Numbers.  AB 1580 is a common-sense proposal that  
            provides parents the tools to proactively protect their  
            child's financial future.  It is time for California to  
            step up and join the many states that have passed similar  
            legislation.  Parents will be able to sleep better at  
            night knowing their child's identity is protected."

          A study conducted by Carnegie Mellon CyLab found that "It is not  
          simply enough to guard your own identity in the 21st Century you  
          must also guard your child's."  This statement highlights the  
          intent of this bill.  Currently, California lacks statutory  
          provisions specific to protected consumers.  Twenty-three other  
          states have a security freeze process in place for protected  


                                                                    AB 1580

                                                                    Page  8

          consumers, where as in most cases a protected consumer is  
          considered to be 16 years of age or younger.  The concept of a  
          protected consumer is fairly new due to the fact protected  
          consumers do not have access to credit therefore should not have  
          a credit file.  If a protected consumer becomes a victim of  
          identity theft they unfortunately do not become aware of this  
          fact until he or she applies for credit as an adult.  

          This bill creates a process where a protected consumer's  
          representative, most likely a parent, has the option to place  
          and remove a security freeze on a protected consumer.  To place  
          the freeze, a parent or representative would directly contact a  
          CCRA and submit the request for a credit freeze by mail.   
          Parents would then authenticate their identity and prove they  
          are legally able to act on behalf of the child.  After the  
          request is filed, a record will be created for the child, and  
          the credit record would be frozen within 30 days.  Under the  
          bill, a CCRA would then be prohibited from releasing credit  
          information or customer records for that protected consumer. 

          If a child does not have an existing credit file, this  
          legislation mandates a consumer credit reporting agency to  
          create a credit "record" of the child's personal information for  
          the sole purpose of implementing a credit freeze.  A credit file  
          in nature is directly related to credit worthiness, credit  
          standing, and credit capacity, which are used to determine  
          credit eligibility.  Unlike a credit file, a credit record is  
          created for identity theft prevention purposes.  Therefore,  
          creating and freezing a credit record does not impact a child's  
          eligibility for credit in the future.  Out of the 23 states that  
          allow child credit freezing, a majority use the credit record  
          method of implementation. 

          This bill does not allow a security freeze to be temporarily  
          lifted, nor does it supply a Personal Identification Number for  
          the purpose of lifting the freeze.  Research has shown that it  
          is not uncommon for parents or relatives of a child to commit  
          "friendly fraud" and borrow the child's Social Security Number  
          to apply for credit if they do not qualify based on their own  


                                                                    AB 1580

                                                                    Page  9

          credit score. 

          Child Identity Theft:

          According to the Attorney General's Office, child identity theft  
          happens when someone uses a minor child's personal information,  
          such as name and Social Security number, usually to obtain  
          credit or employment.  Identity thieves may target children  
          because the crime can go undetected for years, often until the  
          child applies for his or her first loan or credit card.

          Since children have perfectly clean backgrounds, no real credit  
          score to speak of, and their parents do not think to monitor the  
          status of their identity, they make easy targets for identity  
          theft.  Identity theft can have negative effects on a child's  
          credit down the line, and they could have trouble securing  
          student loans, getting a decent job, or even purchasing a  
          cellphone.  The study conducted by Carnegie Melon's CyLab, found  
          that 10.2% of the children reported that someone else had used  
          their Social Security number fraudulently.  The worst of these  
          accounts was toward a 16-year-old girl who had reported  
          fraudulent charges of $725,000 under her name.

          Among the 13 million consumers whose identities were stolen in  
          2013, a growing number includes children.  One in 40 families  
          with children under 18 had at least one child whose personal  
          information was compromised, according to a 2012 survey by the  
          Identity Theft Assistance Center and the Javelin Strategy &  
          Research group.  The survey revealed that identity thieves most  
          often steal children's Social Security numbers, since young  
          children seldom have the credit histories acquired by adults,  
          such as credit cards, bank accounts, licenses and financial  
          statements.  The same survey also found 17% of children were  
          victimized for a year or longer.



                                                                    AB 1580

                                                                    Page  10

          In California, consumers have the right to put a "security  
          freeze" on their credit file which can help prevent identity  
          theft.  A security freeze means that the consumer's file cannot  
          be shared with potential creditors.  Most businesses will not  
          open credit accounts without first checking a consumer's credit  
          history.  If credit files are frozen, even someone who has the  
          consumer's name and Social Security number would most likely not  
          be able to get credit in the consumer's name. 

          Security freezes are designed to prevent a CCRA from releasing a  
          credit report without the consumer's consent.  Using a security  
          freeze to take control over who is allowed access to the  
          personal and financial information in a file may delay,  
          interfere with or prohibit the timely approval of any subsequent  
          request or application the consumer makes regarding a new loan,  
          credit, mortgage, insurance, government services or payments,  
          rental housing, employment, investment, license, cellular  
          telephone, utilities, digital signature, Internet credit card  
          transaction or other services, including an extension of credit  
          at point of sale.

          When a consumer places a security freeze on their file, the  
          consumer will be provided a personal identification number or  
          password to use if the consumer chooses to remove the security  
          freeze from their file or authorize the temporary release of  
          their credit report for a specific person or period after the  
          security freeze is in place.  To provide that authorization, the  
          consumer must contact the CCRA and provide all the following:   
          Sufficient identification to verify identity, personal  
          identification number or password provided by the CCRA, a  
          statement that the consumer chooses to remove the security  
          freeze from their file or that the consumer authorizes the CCRA   
          to temporarily release the consumer report.  

          Analysis Prepared by:                        Kathleen OMalley /  
          B. & F. / (916) 319-3081                       FN: 0003603


                                                                    AB 1580

                                                                    Page  11