BILL NUMBER: AB 156 CHAPTERED
BILL TEXT
CHAPTER 768
FILED WITH SECRETARY OF STATE OCTOBER 8, 1997
APPROVED BY GOVERNOR OCTOBER 7, 1997
PASSED THE ASSEMBLY SEPTEMBER 10, 1997
PASSED THE SENATE SEPTEMBER 5, 1997
AMENDED IN SENATE AUGUST 29, 1997
AMENDED IN SENATE AUGUST 11, 1997
AMENDED IN SENATE JULY 18, 1997
AMENDED IN SENATE JULY 3, 1997
AMENDED IN ASSEMBLY APRIL 17, 1997
AMENDED IN ASSEMBLY MARCH 31, 1997
INTRODUCED BY Assembly Member Murray
(Coauthors: Assembly Members Lempert, Scott, and Wayne)
(Coauthor: Senator Solis)
JANUARY 23, 1997
An act to amend Sections 1785.14, 1785.16, 1785.30, 1785.31, and
1785.33 of the Civil Code, and to add Section 530.5 to the Penal
Code, relating to personal information.
LEGISLATIVE COUNSEL'S DIGEST
AB 156, Murray. Personal information: credit reporting agencies.
(1) The existing Consumer Credit Reporting Agencies Act provides
for the regulation of consumer credit reporting agencies that
regularly engage in whole or in part in the business of assembling or
evaluating consumer credit information or other information on
consumers for the purpose of furnishing consumer credit reports to
3rd parties. Existing law prohibits a consumer credit reporting
agency from furnishing a consumer credit report to any person unless
it has reasonable grounds to believe that the consumer credit report
will be used by this person for expressly provided purposes.
This bill would additionally require a prospective user of the
consumer credit report who is a retail seller to provide the consumer
credit agency with at least 3 categories of information regarding
the consumer that matches, as specified, information within a file
assembled by the consumer credit reporting agency and to certify, in
specified instances, that it requires its employees and agents to
inspect a photo identification of a consumer for credit.
(2) The act specifies procedures for the consumer credit reporting
agency to follow in case a consumer disputes the completeness or
accuracy of any item of information contained in his or her file.
This bill would revise these procedures to, among other things,
require the consumer credit reporting agency to promptly and
permanently block the reporting of disputed information and so notify
the furnisher of the information if the consumer submits a valid
police report concerning the crime described in (4), as specified.
However, the bill would specify certain conditions under which the
information may be unblocked.
(3) The Consumer Credit Reporting Agencies Act prescribes civil
remedies for the violation of the act and provides that the
prevailing parties in any action commenced to obtain these remedies
shall be entitled to recover court costs and reasonable attorney's
fees. The act also prescribes a 2-year statute of limitations from
the date liability arises under the act.
This bill would provide that the prevailing party shall be
entitled to recover these costs and attorney's fees unless the
plaintiff only seeks and obtains injunctive relief to compel
compliance with the act. This bill would revise the statute of
limitations, as specified.
(4) This bill would also provide that it is a misdemeanor for a
person to willfully obtain personal identifying information, as
defined, of another person and use another individual's personal
identifying information and obtain, or attempt to obtain, credit,
goods, or services in the name of the other person without the
consent of that person. By creating a new crime, this bill would
impose a state-mandated local program.
(5) The bill would provide that it will become operative on July
1, 1998, except for the provisions described in (4) above, which
would become operative on January 1, 1998.
(6) The California Constitution requires the state to reimburse
local agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement.
This bill would provide that no reimbursement is required by this
act for a specified reason.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 1785.14 of the Civil Code is amended to read:
1785.14. (a) Every consumer credit reporting agency shall
maintain reasonable procedures designed to avoid violations of
Section 1785.13 and to limit furnishing of consumer credit reports to
the purposes listed under Section 1785.11. These procedures shall
require that prospective users of the information identify
themselves, certify the purposes for which the information is sought
and certify that the information will be used for no other purposes.
From the effective date of this act the consumer credit reporting
agency shall keep a record of the purposes as stated by the user.
Every consumer credit reporting agency shall make a reasonable effort
to verify the identity of a new prospective user and the uses
certified by the prospective user prior to furnishing the user a
consumer report. No consumer credit reporting agency may furnish a
consumer credit report to any person unless the consumer credit
reporting agency has reasonable grounds for believing that the
consumer credit report will be used by the person for the purposes
listed in Section 1785.11. A consumer credit reporting agency does
not have reasonable grounds for believing that a consumer credit
report will be used by the person for the purposes listed in Section
1785.11 unless all of the following requirements are met:
(1) If the prospective user is a retail seller, as defined in
Section 1802.3, and intends to issue credit to a consumer who appears
in person on the basis of an application for credit submitted in
person, the consumer credit reporting agency shall, with a reasonable
degree of certainty, match at least three categories of identifying
information within the file maintained by the consumer credit
reporting agency on the consumer with the information provided to the
consumer credit reporting agency by the retail seller. The
categories of identifying information may include, but are not
limited to, first and last name, month and date of birth, driver's
license number, place of employment, current residence address,
previous residence address, or social security number. The
categories of information shall not include mother's maiden name.
(2) If the prospective user is a retail seller, as defined in
Section 1802.3, and intends to issue credit to a consumer who appears
in person on the basis of an application for credit submitted in
person, the retail seller certifies, in writing, to the consumer
credit reporting agency that it instructs its employees and agents to
inspect a photo identification of the consumer at the time the
application was submitted in person. This paragraph does not apply
to an application for credit submitted by mail.
(3) If the prospective user intends to extend credit by mail
pursuant to a solicitation by mail, the extension of credit shall be
mailed to the same address as on the solicitation unless the
prospective user verifies any address change by, among other methods,
contacting the person to whom the extension of credit will be
mailed.
(b) Whenever a consumer credit reporting agency prepares a
consumer credit report, it shall follow reasonable procedures to
assure maximum possible accuracy of the information concerning the
individual about whom the report relates. These reasonable
procedures shall include, but not be limited to, permanent retention
by the consumer credit reporting agency in the consumer's file, or a
separately individualized file, of that portion of the data in the
file that is used by the consumer credit reporting agency to identify
the individual consumer pursuant to paragraph (1) of subdivision
(a). This permanently retained data shall be available for use in
either a reinvestigation pursuant to subdivision (a) of Section
1785.16, an investigation where the consumer has filed a police
report pursuant to subdivision (k) of Section 1785.16, or a
restoration of a file involving the consumer. If the permanently
retained identifying information is retained in a consumer's file, it
shall be clearly identified in the file in order for an individual
who reviews the file to easily distinguish between the permanently
stored identifying information and any other identifying information
that may be a part of the file. This retention requirement shall not
apply to data that is reported in error, that is obsolete, or that
is found to be inaccurate through the results of a reinvestigation
initiated by a consumer pursuant to subdivision (a) of Section
1785.16.
(c) No consumer credit reporting agency may prohibit any user of
any consumer credit report furnished by the consumer credit reporting
agency from disclosing the contents of the consumer credit report to
the consumer who is the subject of the report if adverse action may
be taken by the user based in whole or in part on the consumer credit
report. The act of disclosure to the consumer by the user of the
contents of a consumer credit report shall not be a basis for
liability of the consumer credit reporting agency or the user under
Section 1785.31.
(d) A consumer credit reporting agency shall provide a written
notice to any person who regularly and in the ordinary course of
business supplies information to the consumer credit reporting agency
concerning any consumer or to whom a consumer credit report is
provided by the consumer credit reporting agency. The notice shall
specify the person's obligations under this title. Copies of the
appropriate code sections shall satisfy the requirement of this
subdivision.
SEC. 2. Section 1785.16 of the Civil Code is amended to read:
1785.16. (a) If the completeness or accuracy of any item of
information contained in his or her file is disputed by a consumer,
and the dispute is conveyed directly to the consumer credit reporting
agency by the consumer or user on behalf of the consumer, the
consumer credit reporting agency shall within a reasonable period of
time and without charge reinvestigate and record the current status
of the disputed information before the end of the 30-business-day
period beginning on the date the agency receives notice of the
dispute from the consumer or user, unless the consumer credit
reporting agency has reasonable grounds to believe and determines
that the dispute by the consumer is frivolous or irrelevant,
including by reason of a failure of the consumer to provide
sufficient information, as requested by the consumer credit reporting
agency, to resolve the dispute. Unless the consumer credit
reporting agency determines that the dispute is frivolous or
irrelevant, before the end of the five-business-day period beginning
on the date the consumer credit reporting agency receives notice of
dispute under this section, the agency shall notify any person who
provided information in dispute at the address and in the manner
specified by the person. A consumer credit reporting agency may
require that disputes by consumers be in writing.
(b) In conducting such a reinvestigation the consumer credit
reporting agency shall review and consider all relevant information
submitted by the consumer with respect to the disputed item of
information. If the consumer credit reporting agency determines that
the dispute is frivolous or irrelevant, it shall notify the consumer
by mail or, if authorized by the consumer for that purpose, by any
other means available to the consumer credit reporting agency, within
five business days after that determination is made that it is
terminating its reinvestigation of the item of information. In this
notification, the consumer credit reporting agency shall state the
specific reasons why it has determined that the consumer's dispute
is frivolous or irrelevant. If the disputed item of information is
found to be inaccurate, missing, or can no longer be verified by the
evidence submitted, the consumer credit reporting agency shall
promptly add, correct, or delete that information from the consumer's
file.
(c) No information may be reinserted in a consumer's file after
having been deleted pursuant to this section unless the person who
furnished the information verifies that the information is accurate.
If any information deleted from a consumer's file is reinserted in
the file, the consumer credit reporting agency shall promptly notify
the consumer of the reinsertion in writing or, if authorized by the
consumer for that purpose, by any other means available to the
consumer credit reporting agency. As part of, or in addition to,
this notice the consumer credit reporting agency shall, within five
business days of reinserting the information, provide the consumer in
writing (1) a statement that the disputed information has been
reinserted, (2) a notice that the agency will provide to the
consumer, within 15 days following a request, the name, address, and
telephone number of any furnisher of information contacted or which
contacted the consumer credit reporting agency in connection with the
reinsertion, (3) the toll-free telephone number of the consumer
credit reporting agency that the consumer can use to obtain this
name, address, and telephone number, and (4) a notice that the
consumer has the right to a reinvestigation of the information
reinserted by the consumer credit reporting agency and to add a
statement to his or her file disputing the accuracy or completeness
of the information.
(d) A consumer credit reporting agency shall provide notice to the
consumer of the results of any reinvestigation under this
subdivision, within five days of completion of the reinvestigation.
The notice shall include (1) a statement that the reinvestigation is
completed, (2) a consumer credit report that is based on the consumer'
s file as that file is revised as a result of the reinvestigation,
(3) a description or indication of any changes made in the consumer
credit report as a result of those revisions to the consumer's file,
(4) a notice that, if requested by the consumer, a description of the
procedure used to determine the accuracy and completeness of the
information shall be provided to the consumer by the consumer credit
reporting agency, including the name, business address, and telephone
number of any furnisher of information contacted in connection with
that information, (5) a notice that the consumer has the right to add
a statement to the consumer's file disputing the accuracy or
completeness of the information, and (6) a notice that the consumer
has the right to request that the consumer credit reporting agency
furnish notifications under subdivision (h). A consumer credit
reporting agency shall provide the notice pursuant to this
subdivision respecting the procedure used to determine the accuracy
and completeness of information, not later than 15 days after
receiving a request from the consumer.
(e) The presence of information in the consumer's file that
contradicts the contention of the consumer shall not, in and of
itself, constitute reasonable grounds for believing the dispute is
frivolous or irrelevant.
(f) If the consumer credit reporting agency determines that the
dispute is frivolous or irrelevant, or if the reinvestigation does
not resolve the dispute, or if the information is reinserted into the
consumer's file pursuant to subdivision (c), the consumer may file a
brief statement setting forth the nature of the dispute. The
consumer credit reporting agency may limit these statements to not
more than 100 words if it provides the consumer with assistance in
writing a clear summary of the dispute.
(g) Whenever a statement of dispute is filed, the consumer credit
reporting agency shall, in any subsequent consumer credit report
containing the information in question, clearly note that the
information is disputed by the consumer and shall include in the
report either the consumer's statement or a clear and accurate
summary thereof.
(h) Following the deletion of information from a consumer's file
pursuant to this section, or following the filing of a statement of
dispute pursuant to subdivision (f), the consumer credit reporting
agency shall, at the request of the consumer, furnish notification
that the item of information has been deleted or that the item of
information is disputed. In the case of disputed information, the
notification shall include the statement or summary of the dispute
filed pursuant to subdivision (f). This notification shall be
furnished to any person, specifically designated by the consumer, who
has, within two years prior to the deletion or the filing of the
dispute, received a consumer credit report concerning the consumer
for employment purposes, or who has, within six months of the
deletion or the filing of the dispute, received a consumer credit
report concerning the consumer for any other purpose, if these
consumer credit reports contained the deleted or disputed
information. The consumer credit reporting agency shall clearly and
conspicuously disclose to the consumer his or her rights to make a
request for this notification. The disclosure shall be made at or
prior to the time the information is deleted pursuant to this section
or the consumer's statement regarding the disputed information is
received pursuant to subdivision (f).
(i) A consumer credit reporting agency shall maintain reasonable
procedures designed to prevent the reappearance in a consumer's file
and in consumer credit reports of information that has been deleted
pursuant to this section and not reinserted pursuant to subdivision
(c).
(j) If the consumer's dispute is resolved by deletion of the
disputed information within three business days, beginning with the
day the consumer credit reporting agency receives notice of the
dispute in accordance with subdivision (a), and provided that
verification thereof is provided to the consumer in writing within
five business days following the deletion, then the consumer credit
reporting agency shall be exempt from requirements for further action
under subdivisions (d), (f), and (g).
(k) If a consumer submits to a credit reporting agency a copy of a
valid police report filed pursuant to Section 530.5 of the Penal
Code, the consumer credit reporting agency shall promptly and
permanently block reporting any information that the consumer alleges
appears on his or her credit report as a result of a violation of
Section 530.5 of the Penal Code so that the information cannot be
reported. The consumer credit reporting agency shall promptly notify
the furnisher of the information that the information has been so
blocked. Furnishers of information and consumer credit reporting
agencies shall ensure that information is unblocked only upon a
preponderance of the evidence establishing the facts required under
paragraph (1), (2), or (3). The permanently blocked information shall
be unblocked only if: (1) the information was blocked due to fraud,
or (2) the consumer agrees that the blocked information, or portions
of the blocked information, were blocked in error, or (3) the
consumer knowingly obtained possession of goods, services, or moneys
as a result of the blocked transaction or transactions or the
consumer should have known that he or she obtained possession of
goods, services, or moneys as a result of the blocked transaction or
transactions. If blocked information is unblocked pursuant to this
subdivision, the consumer shall be promptly notified in the same
manner as consumers are notified of the reinsertion of information
pursuant to subdivision (c). The prior presence of the blocked
information in the consumer credit reporting agency's file on the
consumer is not evidence of whether the consumer knew or should have
known that he or she obtained possession of any goods, services, or
moneys. For the purposes of this subdivision, fraud may be
demonstrated by circumstantial evidence. In unblocking information
pursuant to this subdivision, furnishers and consumer credit
reporting agencies shall be subject to their respective requirements
pursuant to this title regarding the completeness and accuracy of
information.
SEC. 3. Section 1785.30 of the Civil Code is amended to read:
1785.30. Upon notification of the results of a consumer credit
reporting agency's reinvestigation pursuant to Section 1785.16, an
consumer may make a written demand on any person furnishing
information to the consumer credit reporting agency to correct any
information which the consumer believes to be inaccurate. The person
upon whom the written demand is made shall acknowledge the demand
within 30 days. The consumer may require the consumer credit
reporting agency to indicate on any subsequent reports issued during
the dispute that the item or items of information are in dispute. If
upon investigation the information is found to be inaccurate or
incorrect, the consumer may require the consumer credit reporting
agency to delete or correct the item or items of information within a
reasonable time. If within 90 days the consumer credit reporting
agency does not receive any information from the person requested to
furnish the same or any communication relative to this information
from this person, the consumer credit reporting agency shall delete
the information from the report.
SEC. 4. Section 1785.31 of the Civil Code is amended to read:
1785.31. (a) Any consumer who suffers damages as a result of a
violation of this title by any person may bring an action in a court
of appropriate jurisdiction against that person to recover the
following:
(1) In the case of a negligent violation, actual damages,
including court costs, loss of wages, attorney's fees and, when
applicable, pain and suffering.
(2) In the case of a willful violation:
(A) Actual damages as set forth in paragraph (1) above:
(B) Punitive damages of not less than one hundred dollars ($100)
nor more than five thousand dollars ($5,000) for each violation as
the court deems proper;
(C) Any other relief which the court deems proper.
(3) In the case of liability of a natural person for obtaining a
consumer credit report under false pretenses or knowingly without a
permissible purpose, an award of actual damages pursuant to paragraph
(1) or subparagraph (A) of paragraph (2) shall be in an amount of
not less than two thousand five hundred dollars ($2,500).
(b) Injunctive relief shall be available to any consumer aggrieved
by a violation or a threatened violation of this title whether or
not the consumer seeks any other remedy under this section.
(c) Notwithstanding any other provision of this section, any
person who willfully violates any requirement imposed under this
title may be liable for punitive damages in the case of a class
action, in an amount that the court may allow. In determining the
amount of award in any class action, the court shall consider among
relevant factors the amount of any actual damages awarded, the
frequency of the violations, the resources of the violator and the
number of persons adversely affected.
(d) The prevailing parties in any action commenced under this
section shall be entitled to recover court costs and reasonable
attorney's fees, unless the plaintiff only seeks and obtains
injunctive relief to compel compliance with this title. If the
plaintiff only seeks and obtains injunctive relief to compel
compliance with this title, court costs and attorney's fees shall be
awarded pursuant to Section 1021.5 of the Code of Civil Procedure.
SEC. 5. Section 1785.33 of the Civil Code is amended to read:
1785.33. An action to enforce any liability created under this
chapter may be brought in any appropriate court of competent
jurisdiction within two years from the date the plaintiff knew of, or
should have known of, the violation of this title, but not more than
seven years from the earliest date on which liability could have
arisen, except that where a defendant has materially and willfully
misrepresented any information required under this chapter to be
disclosed to a consumer and the information so misrepresented is
material to the establishment of the defendant's liability to the
consumer under this chapter, the action may be brought at any time
within two years after the discovery by the consumer of the
misrepresentation.
SEC. 6. Section 530.5 is added to the Penal Code, to read:
530.5. Every person who willfully obtains personal identifying
information, as defined in subdivision (b), of another person without
the authorization of that person, and uses that information to
obtain, or attempt to obtain, credit, goods, or services in the name
of the other person without the consent of that person is guilty of a
public offense, and upon conviction therefor, shall be punished by
imprisonment in a county jail not to exceed one year, or by a fine
not to exceed one thousand dollars ($1,000), or both.
(b) "Personal identifying information," as used in this section,
means the name, address, telephone number, driver's license number,
social security number, place of employment, employee identification
number, mother's maiden name, demand deposit account number, savings
account number, or credit card number of an individual person.
SEC. 7. The provisions of this act shall become operative July 1,
1998, except for Section 6, which shall become operative on January
1, 1998.
SEC. 8. The provisions, sections, subdivisions, paragraphs,
sentences, words, and clauses of this act are severable. If any
provision, section, subdivision, paragraph, sentence, word, or
clause, or any application thereof, of this act is held invalid, that
invalidity shall not affect the other provisions, sections,
subdivisions, paragraphs, sentences, words, or clauses.
SEC. 9. No reimbursement is required by this act pursuant to
Section 6 of Article XIIIB of the California Constitution because the
only costs that may be incurred by a local agency or school district
will be incurred because this act creates a new crime or infraction,
eliminates a crime or infraction, or changes the penalty for a crime
or infraction, within the meaning of Section 17556 of the Government
Code, or changes the definition of a crime within the meaning of
Section 6 of Article XIIIB of the California Constitution.
Notwithstanding Section 17580 of the Government Code, unless
otherwise specified, the provisions of this act shall become
operative on the same date that the act takes effect pursuant to the
California Constitution.