BILL NUMBER: SB 1767 AMENDED
BILL TEXT
AMENDED IN ASSEMBLY AUGUST 7, 2000
AMENDED IN ASSEMBLY JUNE 28, 2000
AMENDED IN SENATE MAY 31, 2000
AMENDED IN SENATE MAY 25, 2000
AMENDED IN SENATE MAY 8, 2000
AMENDED IN SENATE APRIL 13, 2000
INTRODUCED BY Senator Bowen
(Coauthor: Assembly Member Alquist)
FEBRUARY 23, 2000
An act to amend Section 1785.15 of, to add Sections 1785.111
and 1785.112 , 1785.112, and 1785.113
to, and to add Title 1.6G (commencing with Section 1789.40) and Title
1.81 (commencing with Section 1798.80) to Part 4 of Division 3 of,
the Civil Code, relating to identity theft.
LEGISLATIVE COUNSEL'S DIGEST
SB 1767, as amended, Bowen. Credit: confidentiality: identity
theft.
(1) The Consumer Credit Reporting Agencies Act and the federal
Fair Credit Reporting Act provide for the regulation of consumer
credit reporting agencies, commonly known as credit bureaus, which
collect credit-related information on consumers and report this
information to subscribers. The Consumer Credit Reporting Act
requires certain notices and disclosures to be provided to consumers
with a mailing address in California, including a requirement for
providing a copy of a consumer's credit file to the consumer for a
reasonable fee not exceeding $8, and a requirement to provide a
toll-free telephone number for certain purposes, including the
opportunity for a consumer to elect to have his or her name removed
from lists supplied to creditors that are used to make firm offers of
credit, as defined, that were not initiated by the consumer.
This bill would require credit bureaus to also accept
identity theft fraud security alerts from
consumers via a toll-free telephone number, and would allow a
consumer to request a credit bureau to impose a security
freeze on release of any information from his or her file. The bill
would provide that the freeze would not apply to persons or
entities or the subsidiaries and affiliates of those persons or
entities that have a preexisting business relationship with the
consumer and that request access to the consumer's credit report
information for specified purposes require a consumer
credit reporting agency to place a security alert in a consumer
credit report within 72 hours of receiving a request to do so and to
notify persons using consumer credit reports of the existence of a
security alert. The bill would provide that the security alert would
remain in effect for at least 90 days and that it could be renewed
by a consumer. The bill would also require a consumer credit
reporting agency to place a security freeze on a consumer credit
report within 72 hours of receiving a request to do so in writing,
and would prohibit the release of information from a consumer credit
report while the freeze is in place, except as provided. Among other
things, the bill would also require a consumer credit reporting
agency to provide a consumer an identification number to be used for
authorizing the subsequent release of information from a consumer
credit report that is subject to a security freeze, and would provide
that a security freeze shall remain in effect until a consumer makes
a written request to have the security freeze removed. The bill
would further require that, if a security alert or security freeze is
in place, a consumer credit reporting agency must provide a consumer
with written confirmation before making specified changes to
information in a consumer's credit report .
(2) Existing law provides for the use of social security numbers
as a means of identification in numerous applications.
This bill would prohibit any person or entity, or state or local
agency from assigning any person's social security number
as account numbers or member numbers, except with respect to social
security, tax, credit, or law enforcement purposes. The bill would
specify the dates on and after which this prohibition applies to new
accounts or memberships created on or after July 1, 2001, and those
created before that date , as of a specified date,
from using an individual's Social Security number in certain ways,
including posting it publicly or requiring it for access to products
or services. This bill would provide an exception to the
above-described provisions for a person or entity, or state or local
agency, that meets specified conditions, but would provide that an
individual may prohibit the use of his or her Social Security in
these circumstances by making a written request and that there may be
no charge for implementing this request. This bill would also
permit a state or local agency to use a Social Security number to
perform functions authorized by law if the use does not result in or
require the release of the Social Security number to unauthorized
individuals . The bill would also specify that the prohibition
shall become inoperative as to providers of health care, health care
service plans, licensed health care professionals, or contractors,
as defined, upon the effective date of a certain federal law.
(3) Existing law provides that identity theft is a crime.
This bill would require a credit grantor to provide a consumer
with a copy of the original credit application submitted by an
unauthorized person applying for credit in the consumer's name if the
consumer notifies the credit grantor that he or she is a victim of
identity theft, provides specified information, and makes a written
request. This bill would impose additional requirements on
retail credit grantors who extend credit to consumers who apply for
credit in person also require a credit grantor that
intends to extend credit pursuant to a solicitation by mail, to mail
the extension to the same address as the solicitation, except as
specified .
(4) This bill would enact other related provisions.
Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 1785.111 is added to the Civil Code, to read:
1785.111. (a) The toll-free telephone number maintained
by a consumer credit reporting agency pursuant to subdivision (d) of
Section 1785.11 shall also be staffed to accept identity theft fraud
alerts of consumers submitted pursuant to subdivision (k) of Section
1785.16.
(b) The toll-free telephone number shall be included in all
communications between a consumer credit reporting agency and a
consumer and shall be printed in at least 14-point boldface type.
A consumer may elect to place a security alert in his
or her credit report by making a request in writing or by telephone
to a consumer credit reporting agency.
(b) A consumer credit reporting agency shall notify each person
requesting consumer credit information with respect to a consumer of
the existence of a security alert in the credit report of that
consumer, regardless of whether a full credit report, credit score,
or summary report is requested.
(c) Each consumer credit reporting agency shall maintain a
toll-free telephone number to accept security alert requests from
consumers 24 hours a day, seven days a week.
(d) The toll-free telephone number shall be included in any
written disclosure by a consumer credit reporting agency to any
consumer pursuant to Section 1785.15 and shall be printed in a clear
and conspicuous manner.
(e) A consumer credit report agency shall place a security alert
on a consumer's credit report no later than 72 hours after receiving
a request from the consumer.
(f) The security alert shall remain in place for at least 90 days
and a consumer shall have the right to request a renewal of the
security alert.
SEC. 2. Section 1785.112 is added to the Civil Code, to read:
1785.112. A consumer may request a consumer credit
reporting agency to impose a freeze on release of any information
from the consumer's file. The freeze shall be requested in writing,
and shall be in effect until the consumer requests the freeze to be
lifted. The freeze does not apply to persons or entities or the
subsidiaries and affiliates of those persons or entities that have a
preexisting business relationship with the consumer and that request
access to credit report information for the purpose of reviewing the
account, increasing the credit line on the account, taking collection
action on the account, or for other legitimate purposes associated
with the existing account. A consumer credit reporting agency shall
follow reasonable procedures in implementing this section in order to
require proper identification, as defined in subdivision (c) of
Section 1785.15, of the person making a request to impose or lift a
freeze. (a) A consumer may elect to place a security
freeze on his or her credit report by making a request in writing to
a consumer credit reporting agency. When a security freeze is in
place, information from a consumer's credit report shall not be
released to a third party without prior express authorization from
the consumer.
(b) A consumer credit reporting agency shall place a security
freeze on a consumer's credit report no later than 72 hours after
receiving a written request from the consumer.
(c) The consumer credit reporting agency shall send a written
confirmation of the security freeze to the consumer within 10 days
and shall provide the consumer with a unique personal identification
number or password to be used by the consumer when providing
authorization for the release of his or her credit for a specific
purpose.
(d) If the consumer wishes to allow his or her credit report to be
accessed for a specific purpose while a freeze is in place, he or
she shall contact the credit bureau and provide the following:
(1) Proper identification, as defined in subdivision (c) of
Section 1785.15.
(2) The unique personal identification number or password provided
by the credit reporting agency in subdivision (c).
(3) The proper information regarding the third party who is to
receive the credit report.
(e) If a consumer requests a security freeze, the consumer credit
reporting agency shall disclose the process of placing and lifting a
freeze, and the process for allowing access to information from the
consumer's credit report for a specific purpose while the freeze is
in place.
(f) A security freeze shall remain in place until the consumer
requests in writing that the security freeze be removed. A consumer
credit reporting agency shall remove a security freeze within 72
hours of receiving a request for removal in writing from the
consumer.
(g) A consumer credit reporting agency shall require proper
identification, as defined in subdivision (c) of Section 1785.15, of
the person making a request to place or remove a security freeze.
(h) The provisions of this section shall not apply to the use of a
consumer report by the following:
(1) A person or entity, or a subsidiary, affiliate, or agent of
that person or entity, or an assignee of a financial obligation owing
by the consumer to that person or entity, with which the consumer
has or had prior to assignment an account or contract, or to whom the
consumer issued a negotiable instrument, for the purposes of
reviewing the account or collecting the financial obligation owing
for the account, contract, or negotiable instrument. For purposes of
this paragraph, "reviewing the account" includes activities related
to account maintenance, monitoring, credit line increases, and
account upgrades and enhancements.
(2) A law enforcement agency acting pursuant to a court order,
warrant, or subpoena.
(3) A child support agency acting pursuant to Chapter 2 of
Division 17 of the Family Code or Title IV-D of the Social Security
Act (42 U.S.C. et seq.).
(4) The Franchise Tax Board or the Internal Revenue Service, or
their agents or assigns, acting to investigate or collect delinquent
taxes.
(5) The use of credit information for the purposes of prescreening
as provided for by the federal Fair Credit Reporting Act.
SEC. 3. Section 1785.113 is added to the Civil Code, to read:
1785.113. If a security alert or security freeze is in place, a
consumer credit reporting agency shall not modify any of the
following information in a consumer credit report without sending a
written confirmation of the change to the consumer: last name, date
of birth, age, Social Security number, address, and telephone number.
In the case of an address change, the written confirmation shall be
sent to both the new address and to the former address.
SEC. 3.
SEC. 4. Section 1785.15 of the Civil Code is amended to
read:
1785.15. (a) A consumer credit reporting agency shall supply
files and information required under Section 1785.10 during normal
business hours and on reasonable notice. In addition to the
disclosure provided by this chapter and any disclosures received by
the consumer, the consumer has the right to request and receive all
of the following:
(1) Either a decoded written version of the file or a written copy
of the file, including all information in the file at the time of
the request, with an explanation of any code used.
(2) A record of all inquiries, by recipient, which result in the
provision of information concerning the consumer in connection with a
credit transaction that is not initiated by the consumer and which
were received by the consumer credit reporting agency in the
six-month period immediately preceding the request for disclosure
under this section.
(3) The recipients, including end users specified in Section
1785.22, of any consumer credit report on the consumer which the
consumer credit reporting agency has furnished:
(A) For employment purposes within the two-year period preceding
the request.
(B) For any other purpose within the six-month period preceding
the request.
Identification for purposes of this paragraph shall include the
name of the recipient or, if applicable, the fictitious business name
under which the recipient does business disclosed in full. If
requested by the consumer, the identification shall also include the
address of the recipient.
(b) Files maintained on a consumer shall be disclosed promptly as
follows:
(1) In person, at the location where the consumer credit reporting
agency maintains the trained personnel required by subdivision (d),
if he or she appears in person and furnishes proper identification.
(2) By mail, if the consumer makes a written request with proper
identification for a copy of the file or a decoded written version of
that file to be sent to the consumer at a specified address. A
disclosure pursuant to this paragraph shall be deposited in the
United States mail, postage prepaid, within five business days after
the consumer's written request for the disclosure is received by the
consumer credit reporting agency. Consumer credit reporting agencies
complying with requests for mailings under this section shall not be
liable for disclosures to third parties caused by mishandling of
mail after those mailings leave the consumer reporting agencies.
(3) A summary of all information contained in files on a consumer
and required to be provided by Section 1785.10 shall be provided by
telephone, if the consumer has made a written request, with proper
identification for telephone disclosure.
(4) Information in a consumer's file required to be provided in
writing under this section may also be disclosed in another form if
authorized by the consumer and if available from the consumer credit
reporting agency. For this purpose a consumer may request disclosure
in person pursuant to Section 1785.10, by telephone upon disclosure
of proper identification by the consumer, by electronic means if
available from the consumer credit reporting agency, or by any other
reasonable means that is available from the consumer credit reporting
agency.
(c) "Proper identification," as used in subdivision (b) means that
information generally deemed sufficient to identify a person. Only
if the consumer is unable to reasonably identify himself or herself
with the information described above, may a consumer credit reporting
agency require additional information concerning the consumer's
employment and personal or family history in order to verify his or
her identity.
(d) The consumer credit reporting agency shall provide trained
personnel to explain to the consumer any information furnished him or
her pursuant to Section 1785.10.
(e) The consumer shall be permitted to be accompanied by one other
person of his or her choosing, who shall furnish reasonable
identification. A consumer credit reporting agency may require the
consumer to furnish a written statement granting permission to the
consumer credit reporting agency to discuss the consumer's file in
that person's presence.
(f) Any written disclosure by a consumer credit reporting agency
to any consumer pursuant to this section shall include a written
summary of all rights the consumer has under this title and in the
case of a consumer credit reporting agency which compiles and
maintains consumer credit reports on a nationwide basis, a toll-free
telephone number which the consumer can use to communicate with the
consumer credit reporting agency. The written summary of rights
required under this subdivision is sufficient if in substantially the
following form:
"You have a right to obtain a copy of your credit file from a
consumer credit reporting agency. You may be charged a reasonable
fee not exceeding eight dollars ($8). There is no fee, however, if
you have been turned down for credit, employment, insurance, or a
rental dwelling because of information in your credit report within
the preceding 60 days. The consumer credit reporting agency must
provide someone to help you interpret the information in your credit
file.
You have a right to dispute inaccurate information by contacting
the consumer credit reporting agency directly. However, neither you
nor any credit repair company or credit service organization has the
right to have accurate, current, and verifiable information removed
from your credit report. Under the Federal Fair Credit Reporting Act,
the consumer credit reporting agency must remove accurate, negative
information from your report only if it is over seven years old.
Bankruptcy information can be reported for 10 years.
If you have notified a credit reporting agency in writing that you
dispute the accuracy of information in your file, the consumer
credit reporting agency must then, within 30 business days,
reinvestigate and modify or remove inaccurate information. The
consumer credit reporting agency may not charge a fee for this
service. Any pertinent information and copies of all documents you
have concerning an error should be given to the consumer credit
reporting agency.
If reinvestigation does not resolve the dispute to your
satisfaction, you may send a brief statement to the consumer credit
reporting agency to keep in your file, explaining why you think the
record is inaccurate. The consumer credit reporting agency must
include your statement about disputed information in a report it
issues about you.
You have a right to receive a record of all inquiries relating to
a credit transaction initiated in six months preceding your request.
This record shall include the recipients of any consumer credit
report.
You may request in writing that the information contained in your
file not be provided to a third party for marketing purposes.
If you are concerned about identity theft and do not intend
to apply for credit in the near future, you may request, in writing,
a freeze to be imposed on the information in your file, which, once
imposed, will remain in effect until you request to have the freeze
lifted. If a freeze is imposed, no information will be released to
any grantor of credit, except information about an existing account
with a grantor of credit with whom you have a preexisting business
relationship, and you may be denied credit until the freeze is
lifted.
You have a right to place a "security alert" in your credit
report, which will warn anyone who receives information in your
credit report that your identity may have been used without your
consent and verification of identity is advised. A security alert
may be requested by calling the following toll-free number:
_________.
You have a right to place a "security freeze" on your credit
report, which will prohibit a consumer credit reporting agency from
releasing any information in your credit report without your express
authorization. A security freeze must be requested in writing and
may delay or interfere with the approval of any application you file
for a new loan, credit, insurance or service. When you place a
security freeze on your credit report, you will be provided a
personal identification number or password to use if you choose to
authorize the release of your credit report for a specific purpose
after the freeze is in place. To provide that authorization you must
contact the consumer credit reporting agency and provide all of the
following:
(1) The personal identification number or password.
(2) Proper identification to verify your identity.
(3) The proper information regarding the third party who is to
receive the credit report.
A security freeze does not apply to a person or entity, or it
affiliates, or collection agencies acting on behalf the person or
entity, with which you have an existing account, that requests
information in your credit report for the purposes of reviewing or
collecting the account. Reviewing the account includes activities
related to account maintenance, monitoring, credit line increases,
and account upgrades and enhancements.
You have a right to bring civil action against anyone who
improperly obtains access to a file or knowingly or willfully misuses
file data."
SEC. 4.
SEC. 5. Title 1.6G (commencing with Section 1789.40) is
added to Part 4 of Division 3 of the Civil Code, to read:
TITLE 1.6G. OBLIGATIONS OF CERTAIN CREDIT GRANTORS
Article 1. General Provisions
1789.40. The requirements of this title are in addition to other
requirements imposed by law.
Article 2. All Credit Grantors
1789.41. A consumer who discovers that an application in his or
her name for a loan, credit card, or charge card has been made by an
unauthorized person and who provides a written notice that he or she
is a victim of identity theft, a copy of the police report filed by
the victim pursuant to Section 530.5 of the Penal Code, and a written
request, shall be entitled to receive a copy of the original credit
application form or application information from the credit grantor,
which shall provide the copy within 10 business days of receiving a
request.
1789.42. A credit grantor shall not grant credit to a person if a
credit report concerning that person obtained by the credit grantor
from a consumer credit reporting agency indicates that a fraud alert
has been reported to the consumer credit reporting agency pursuant to
subdivision (k) of Section 1785.16 and if the consumer credit
reporting agency reports that a credit freeze has been requested
pursuant to Section 1785.112.
Article 3. Retail Seller Credit Grantors
1789.46. This article shall apply to a credit grantor that is a
retail seller, as defined in Section 1802.3, and that intends to
issue credit to a consumer.
1789.48.
1789.43. If a credit grantor subject to this article
intends to extend credit by mail pursuant to a solicitation by mail,
the extension of credit shall be mailed to the same address as on the
solicitation unless the credit grantor verifies any address change
by, among other methods, contacting the person to whom the extension
of credit will be mailed.
SEC. 5.
SEC. 6. Title 1.81 (commencing with Section 1798.80) is
added to Part 4 of Division 3 of the Civil Code, to read:
TITLE 1.81. CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS
1798.80. (a) No person or entity, and no state or local
agency, shall assign Social Security numbers as account numbers or
member numbers, except with respect to Social Security, tax, or law
enforcement purposes.
(b) Subdivision (a) shall apply to all new accounts or memberships
created on or after July 1, 2001. Beginning on January 1, 2003,
subdivision (a) shall apply to all accounts or memberships created
before July 1, 2001. This section shall not apply to closed accounts
or memberships.
(c) A person or entity, or state or local agency,
shall not do any of the following:
(1) Publicly post or display in any manner an individual's Social
Security number.
(2) Print an individual's Social Security number on any card
required for the individual to access products or services provided
by the person, entity, state or local agency.
(3) Require an individual to transmit his or her Social Security
number over the Internet unless the connection is secure or the
Social Security number is encrypted.
(4) Require an individual to use his or her Social Security number
to access an Internet website, unless a password or unique personal
identification number is also required to access the website.
(5) Print an individual's Social Security number on any materials
that are mailed to the individual, unless state or federal law
requires the Social Security number to be on the document to be
mailed. Notwithstanding this provision, applications and forms sent
by mail may include Social Security numbers.
(b) Except as provided in subdivision (c), subdivision (a) applies
only to the use of Social Security numbers on or after July 1, 2001.
(c) Notwithstanding any other provision of law, a person or
entity, or state or local agency, that has used, prior to July 1,
2001, an individual's Social Security number in a manner inconsistent
with subdivision (a), may continue using that individual's Social
Security number in that manner on or after July 1, 2001, if all of
the following conditions are met:
(1) The use of the Social Security number is continuous. If the
use is stopped for any reason, subdivision (a) shall apply.
(2) The individual is provided an annual disclosure, commencing in
the year 2002, that informs the individual that he or she has the
right to stop the use of his or her Social Security number in a
manner prohibited by subdivision (a).
(3) A written request by an individual to stop the use of his or
her Social Security number in a manner prohibited by subdivision (a)
shall be implemented within 30 days of the receipt of the request.
There shall be no fee or charge for implementing the request.
(4) A person or entity, or state or local agency shall not deny
services to an individual because the individual makes a written
request pursuant to this subdivision.
(d) This section shall not prevent a state or local agency from
using a Social Security number for internal verification and
administrative purposes, providing that the use does not result in,
or require the release of, the Social Security number to persons not
designated by the public agency to perform associated functions
authorized by law.
(e) This section shall become inoperative with respect to a
provider of health care, a health care service plan, a licensed
health care professional, or a contractor, as those terms are defined
in Section 56.05 of the Civil Code, on and after the date a federal
law takes effect requiring the United States Department of Health and
Human Services to establish a national unique patient health
identifier program.