BILL ANALYSIS Ó
SENATE JUDICIARY COMMITTEE
Senator Hannah-Beth Jackson, Chair
2015-2016 Regular Session
SB 441 (Wolk)
Version: June 22, 2016
Hearing Date: August 17, 2016
Fiscal: Yes
Urgency: No
NR
SUBJECT
California Public Records Act: exemptions
DESCRIPTION
This bill would exempt from disclosure under the California
Public Records Act any identification number, alphanumeric
character, or other unique identifying code used by a public
agency to identify a vendor or contractor, as specified.
BACKGROUND
In April of this year, the City of Dixon uncovered a
sophisticated criminal attempt to divert a vendor's electronic
fund transfer into a fraudulently held bank account. Upon
becoming aware of the situation, the City of Dixon took
immediate action to stop the transfer and was successful in
returning the funds to the City's bank account. Ultimately, $1.3
million was at stake.
Dixon immediately initiated its own investigation, which, once
completed, found that the perpetrators facilitated their scheme
using public information made available online. In early March,
the perpetrators sent a fraudulent email to Dixon City staff and
included a letter via attachment, on what appeared to be the
vendor's letterhead. The letter provided specific payment
change instructions and included the vendor's unique
identification number, a number used by the City for billing and
bookkeeping purposes.
Dixon's investigation concluded that the vendor number was most
SB 441 (Wolk)
Page 2 of ?
likely found through a simple Internet search. The vendor
numbers are easily obtainable and found in the "enumeration of
claims" published as part of the City Council agenda packet,
which is available online and upon request. This bill, seeking
to reduce the risk of a public agency falling victim to the type
of fraud the City of Dixon faced earlier this year, would exempt
these numbers from disclosure under the California Public
Records Act.
CHANGES TO EXISTING LAW
Existing law , the California Constitution, declares the people's
right to transparency in government. ("The people have the
right of access to information concerning the conduct of the
people's business, and therefore, the meetings of public bodies
and the writings of public officials and agencies shall be open
to public scrutiny....") (Cal. Const., art. I, Sec. 3.)
Existing law , the California Public Records Act (CPRA), governs
the public disclosure of information collected and maintained by
public agencies. (Gov. Code Sec. 6250 et seq.) Generally, all
public records are accessible to the public upon request, unless
the record requested is exempt from public disclosure. (Gov.
Code Sec. 6253.) There are 30 general categories of documents
or information that are exempt from disclosure, essentially due
to the character of the information, and unless it is shown that
the public's interest in disclosure outweighs the public's
interest in non-disclosure of the information, the exempt
information may be withheld by the public agency with custody of
the information. (Gov. Code Sec. 6254 et seq.)
This bill would provide that nothing in the CPRA requires the
disclosure of an identification number, alphanumeric character,
or other unique identifying code that a public agency uses to
identify a vendor or contractor, or an affiliate of a vendor or
contractor, unless the identification number, alphanumeric
character, or other unique identifying code is used in a public
bidding or an audit involving the public agency.
This bill would find and declare, as required by the California
Constitution, that this limitation on the public's right of
access to public records is necessary to protect the public
interest by balancing the right of the public to access relevant
information about contractors, vendors, and their affiliates
used by public agencies, while at the same time preventing the
SB 441 (Wolk)
Page 3 of ?
misuse of identification information that may be used to defraud
local agencies.
COMMENT
1.Stated need for the bill
According to the author:
[A] few months ago, the City of Dixon was the victim of an
attempt to fraudulently divert $1.3 million through an
automatic payment system. The attempted fraud was
orchestrated using the City's public information against
itself. An investigation concluded that the perpetrators
facilitated their scheme by using public information made
available online.
Today, there is no specific exemption in the California Public
Records Act that allows a city to redact vendor information
numbers. SB 441 would make confidential any identification
number or other unique code used by public agencies to
identify a vendor or contractor except in cases of public
bidding or when used for an audit.
2.Strikes balance between transparency of public agencies and
protection of privacy
The State of California simultaneously grants the public a right
to access records collected and maintained by public agencies,
and an individual's constitutional right to privacy. In
circumstances where these two principles are in conflict, the
Legislature has approved limited exceptions, seeking to strike
an appropriate balance. There are 30 general categories of
documents or information that are exempt from disclosure,
essentially due to the character of the information, and unless
it is shown that the public's interest in disclosure outweighs
the public's interest in non-disclosure of the information, the
exempt information may be withheld by the public agency with
custody of the information. (Gov. Code Sec. 6254 et seq.) For
example, while employee records fall within the scope of the
California Public Records Act (CPRA) and are therefore subject
to disclosure, in order to protect the individual employee's
right to privacy, existing law provides that the home addresses
and private telephone numbers of employees "shall not be deemed
to be public records and shall not be open to public
SB 441 (Wolk)
Page 4 of ?
inspection[.]"(Gov. Code Sec. 6254.3.)
In response to the attempted diversion of funds from the City of
Dixon earlier this year, this bill would additionally provide
that nothing in the CPRA requires the disclosure of an
identification number, alphanumeric character, or other unique
identifying code that a public agency uses to identify a vendor
or contractor, as specified. This will arguably strike an
appropriate balance between the competing interests of public
access to government records and the need to protect public
agencies against fraud by acknowledging that the public has an
interest in knowing the identity of vendors and contractors that
receive public funds, but also recognizing that there is no
significant interest in knowing the otherwise random numbers or
alphanumeric codes that the agency uses for internal
administrative purposes. In support, the League of California
Cities writes:
League policy holds that revisions to laws governing local
agency transparency should address material and documented
inadequacies in those laws and have a reasonable relationship
to resolving those problems. This measure addresses concerns
arising from documented attempts to defraud local agencies and
appropriately considers the public interest served by not
disclosing unique vendor identification numbers. Unique vendor
numbers serve only to allow city staff to correctly and
efficiently issue and track payments. Under this measure,
public disclosure of vendors and amounts paid will still be
available. It is our belief that this measure will help deter
and prevent attempts to defraud local agencies.
3.Ensures that information used in public processes will remain
subject to public disclosure
In response to concerns raised by the California Newspapers
Association, the author exempted identification numbers,
alphanumeric characters, or other unique identifying codes used
in a public bidding or an audit involving the public agency,
thereby ensuring that this information will remain available
subject to a CPRA request. As a result, this bill is narrowly
tailored to address the disclosure of internal administrative
information related to the fraud experienced by the City of
Dixon earlier this year, without compromising the public's
access to information used in public processes such as bidding
for public contracts and audits of public agencies.
SB 441 (Wolk)
Page 5 of ?
In support, the Rio Linda-Elverta Community Water District
writes:
Currently there is no specific exemption in the CPRA to
prevent the disclosure of vendor identification numbers.
Accordingly, public agencies subject to the [C]PRA must
provide vendor numbers if requested. Public agencies will be
better served if there is a clear exemption in the [C]PRA from
disclosing vendor identification except when the number is
used in a public bidding or is part of an audit involving the
public agency.
Making vendor numbers confidential would assist public
agencies in detecting fraud and would add another layer of
security to their internal systems. SB 441 seeks to reduce
the risk of a public agency falling victim to this type of
fraud and make it more difficult for criminals to obtain
information meant for internal use and utilize it to carry out
similar scams against public entities.
Support : League of California Cities; Rio Linda-Elverta
Community Water District;
San Miguel Community Services District
Opposition : None Known
HISTORY
Source : City of Dixon
Related Pending Legislation :
AB 2498 (Bonta) This bill would exempt the names, addresses, and
images of victims of human trafficking and their immediate
family, as specified, from disclosure pursuant to the California
Public Records Act (CPRA), and make similar changes in the Penal
Code. This bill is currently on the Senate Floor.
AB 2853 (Gatto) would authorize a public agency to post public
records on its Internet Web site and to direct a person
requesting such a record to that Web site, as specified. This
bill is pending concurrence in the Assembly.
SB 441 (Wolk)
Page 6 of ?
AB 2611 (Low), would prohibit a public agency from disclosing a
visual or audio recording of the death of a peace officer killed
in the line of duty unless the disclosure is authorized by the
officer's immediate family. This bill is pending concurrence in
the Assembly.
AB 1520 (Stone) would create an exception a provision of the
CPRA that exempts from disclosure certain personal information
about customers of local utility agencies for the water usage
rates of industrial, institutional, and commercial utility
customers. This bill is currently on the Senate Floor.
Prior Legislation : None Known
Prior Vote :
Assembly Floor (Ayes 78, Noes 0)
Assembly Appropriations Committee (Ayes 20, Noes 0)
Assembly Judiciary Committee (Ayes 10, Noes 0)
Assembly Rules Committee (Ayes 10, Noes 0)
**************