BILL ANALYSIS �
SENATE JUDICIARY COMMITTEE
Senator Noreen Evans, Chair
2011-2012 Regular Session
SB 1384 (Simitian)
As Introduced
Hearing Date: May 8, 2012
Fiscal: No
Urgency: No
SK
SUBJECT
Consumer Information Privacy
DESCRIPTION
Existing law permits consumers to "freeze" their credit reports
to guard against identity theft. If a consumer freezes his or
her report, information in the report cannot be released by the
credit reporting agency without the consumer's permission. This
bill would allow a consumer to also freeze his or her "specialty
consumer report," defined to mean reports relating to the
consumer's: (1) medical records; (2) residential or tenant
history; (3) check writing history; (4) employment history; or
(5) insurance claims.
BACKGROUND
According to the Federal Trade Commission's "Consumer Sentinel
Network Data Book for January - December 2010," California had
more identity theft complaints-38,148-than any other state. For
every 100,000 people in California, there were 102.4 identity
theft complaints, and only Florida and Arizona had more
complaints per capita. Three of the top 10 largest metropolitan
areas with the highest per capita rates of identity theft
complaints were in California: Madera, Merced, and Bakersfield.
(Federal Trade Commission, Consumer Sentinel Network Data Book
for January - December 2010 (Mar. 2011)
�as of May 5, 2012].)
Identity theft victims' information can be misused in numerous
ways. One of the most common is the creation of new accounts,
including credit card, utility, or wireless telephone accounts.
(more)
SB 1384 (Simitian)
Page 2 of ?
But, victims' information can also be used in other, equally
nefarious ways. For example, according to the Federal Reserve
Bank of Boston, some identity theft victims have reported that
identity thieves used their information to apply for apartments
or print counterfeit checks in their names. (Federal Reserve
Bank of Boston, Identity Theft (Nov. 2005)
�as of May
5, 2012].) And, the Federal Trade Commission notes that "�o]nce
they have your personal information, identity thieves use it in
a variety of ways. . . . They may get a job using your Social
Security number. They may rent a house or get medical services
using your name. . . . You may find out when you get something
in the mail about an apartment you never rented . . . or a job
you never held." (Federal Trade Commission, Fighting Back
Against Identity Theft
�as of May 5, 2012].)
A credit report is a consumer's credit history compiled by a
credit reporting agency. The report contains information such
as annual income, outstanding debt, bill-paying history, the
number, types, and age of accounts, current and previous
addresses, and Social Security number. Under federal law, a
credit reporting agency may disclose information contained in a
credit report to current and prospective creditors, insurers,
employers (provided the consumer has authorized the disclosure),
and others who have a "legitimate business need" in connection
with a business transaction initiated by the consumer. (15
U.S.C. Sec. 1681b.) Federal law requires consumer reporting
agencies to give consumers one free credit report each year.
(15 U.S.C. Sec. 1681j.)
Increasingly, employers, insurers, landlords, and others are
using "specialized" consumer reports to evaluate a consumer's
risk for employment, insurance, and rental housing. Under
federal law, these "specialty consumer reporting agencies"
compile and maintain consumer files relating to: (1) medical
records or payments; (2) residential or tenant history; (3)
check writing history; (4) employment history; or (5) insurance
claims. (15 U.S.C. Sec. 1681a.) Federal law requires specialty
consumer reporting agencies to give consumers one free report
each year. (15 U.S.C. Sec. 1681j.) California's Investigative
Consumer Reporting Agencies Act also regulates specialized
consumer reports and contains requirements related to accuracy
and confidentiality of reports. (Civ. Code Sec. 1786 et seq.)
SB 1384 (Simitian)
Page 3 of ?
Specialty consumer reports are often tailored to the particular
users of the reports. For example, insurers use the
Comprehensive Loss Underwriting Exchange, more commonly known as
"C.L.U.E.," when they are underwriting or rating an insurance
policy. The C.L.U.E. database contains information relating to
a consumer's claims history. Some consumers' medical
information is also compiled by specialty consumer reporting
agencies. For instance, records of individual life, health,
long-term care, and disability insurance are maintained in the
Medical Information Bureau, and other databases contain
information concerning consumers' prescription drug purchase
histories. Landlords use specialized tenant screening reports,
which contain rental payment data to evaluate prospective
tenants, and several companies report on consumers' check
writing history. Employers also use specialized background
screening reports, although they must get the consumer's written
authorization before doing so. (See Privacy Rights
Clearinghouse, Other Consumer Reports: What You Should Know
about 'Specialty' Reports, (Apr. 2012)
�as of
May 5, 2012].)
In 2001, California became the first state to give consumers the
right to place a freeze on their credit reports, which prohibits
a credit reporting agency from releasing the consumer's credit
report without the express authorization of the consumer. (See
SB 168 (Bowen, Ch. 720, Stats. 2001).) Since that time, 46
other states and the District of Columbia have followed
California's lead and enacted security freeze legislation,
limiting disclosure of consumers' credit reports. Six of those
states and the District of Columbia allow consumers to place a
security freeze on some specialty consumer reports as well. For
example, consumers can request that a security freeze be placed
on employment and resident reports in Colorado, Delaware, Maine,
New Hampshire, New Jersey, North Carolina and the District of
Columbia. In Maine and New Jersey, consumers can also freeze
their C.L.U.E. reports.
This bill would extend California's security freeze statute to
permit a consumer to freeze his or her specialty consumer
report.
CHANGES TO EXISTING LAW
Existing federal law defines "nationwide specialty consumer
reporting agency" to mean a consumer reporting agency that
SB 1384 (Simitian)
Page 4 of ?
compiles and maintains files on consumers on a nationwide basis
relating to: (1) medical records or payments; (2) residential or
tenant history; (3) check writing history; (4) employment
history; or (5) insurance claims. (15 U.S.C. Sec. 1681a.)
Existing federal law requires specialty consumer reporting
agencies to give consumers one free report each year upon
request. (15 U.S.C. Sec. 1681j.)
Existing law permits a consumer to place a "security freeze" on
his or her credit report, prohibiting consumer credit reporting
agencies from releasing the consumer's credit report or any
information contained in it unless the consumer expressly
authorizes the release. (Civ. Code Sec. 1785.11.2(a).)
Existing law requires a credit reporting agency to place a
security freeze on a consumer's credit report within three
business days after receiving the consumer's request. (Civ.
Code Sec. 1785.11.2(b).)
Existing law requires a credit reporting agency to send a
written confirmation of the security freeze to the consumer
within 10 business days. The credit reporting agency must also
provide the consumer with a unique personal identification
number or password to be used by the consumer when he or she
authorizes the release of his or her information for a specific
party or period of time. (Civ. Code Sec. 1785.11.2(c).)
Existing law permits a consumer to allow his or her credit
report to be accessed for a specific party or period of time
while a freeze is in place and requires the consumer to provide
specified information to the credit reporting agency so that the
freeze may be temporarily lifted. (Civ. Code Sec.
1785.11.2(d).)
SB 1384 (Simitian)
Page 5 of ?
Existing law requires a credit reporting agency that receives a
consumer's request to temporarily lift a freeze to comply with
that request within three business days. (Civ. Code Sec.
1785.11.2(e).)
Existing law requires a credit reporting agency to develop
procedures involving telephone, fax, the Internet, or other
electronic media to receive and process a consumer's request to
temporarily lift a freeze in an expedited manner. (Civ. Code
Sec. 1785.11.2(f).)
Existing law provides that a credit reporting agency may remove
or temporarily lift a freeze only upon the consumer's request or
if the consumer's credit report was frozen due to a material
misrepresentation of fact by the consumer, in which case the
credit reporting agency must notify the consumer before removing
the freeze. (Civ. Code Sec. 1785.11.2(g).)
Existing law specifies that a third party who requests access to
a consumer's credit report in connection with an application for
credit or any other use may treat that application as incomplete
if a security freeze is in place and the consumer does not allow
access to his or her report for the specific party or period of
time. (Civ. Code Sec. 1785.11.2(h).)
Existing law requires a credit reporting agency to disclose to a
consumer who has requested a freeze the process of placing and
temporarily lifting the freeze and the process for allowing
access to the consumer's information for a specific party or
period of time while the freeze is in effect. (Civ. Code Sec.
1785.11.2(i).)
Existing law requires that a security freeze must remain in
place until the consumer requests that it be removed. If a
consumer requests that the freeze be removed, a credit reporting
agency must comply with that request within three business days
of receiving the request for removal, and the consumer must
provide specified information. (Civ. Code Sec. 1785.11.2(j).)
Existing law provides that a credit reporting agency must
require proper identification, as defined, of a consumer making
a request to place or remove a security freeze. (Civ. Code Sec.
1785.11.2(k).)
Existing law provides that the security freeze statute does not
apply to the use of a credit report by any of the following:
(1) a person or entity with whom the consumer has or had an
SB 1384 (Simitian)
Page 6 of ?
account, as specified; (2) a state or local agency, law
enforcement agency, trial court, or private collection agency
acting pursuant to a court order, warrant, or subpoena; (3) a
child support agency; (4) the State Department of Health Care
Services when investigating Medi-Cal fraud; (5) the Franchise
Tax Board when investigating or collecting delinquent taxes or
unpaid court orders; (6) the use of credit information for
prescreening, as specified; (7) a credit monitoring service to
which the consumer has subscribed; and (8) a person or entity
when providing the consumer a copy of his or her own credit
report. (Civ. Code Sec. 1785.11.2(l).)
Existing law permits a credit reporting agency to charge a fee
of no more than $10 for placing, removing, or temporarily
lifting a freeze. A credit reporting agency may not charge a
fee to an identity theft victim, and may charge a fee of no
more than $5 to a consumer who is 65 years of age and older.
(Civ. Code Sec. 1785.11.2(m).)
Existing law provides that, regardless of the existence of a
security freeze, a consumer reporting agency may disclose public
record information lawfully obtained by the agency from an open
public record to the extent otherwise permitted by law. (Civ.
Code Sec. 1785.11.2(n).)
Existing law provides that, if a security freeze is in place, a
credit reporting agency may not change any of the following
official information without notifying the consumer within 30
days of the change being made to the consumer's file: name,
date of birth, Social Security number, and address. (Civ. Code
Sec. 1785.11.3(a).)
This bill would apply all of the above state law provisions to
"nationwide specialty consumer reporting agencies."
This bill would define a "nationwide specialty consumer
reporting agency" to mean a consumer reporting agency that
compiles and maintains files on consumers on a nationwide basis
relating to any of the following: (1) medical records or
payments; (2) residential or tenant history; (3) check writing
history; (4) employment history; or (5) insurance claims.
COMMENT
1.Stated need for the bill
SB 1384 (Simitian)
Page 7 of ?
The author writes:
An individual may want to place a security freeze on his or
her credit report to prevent credit, loans, and services from
being approved in his or her name without consent. Similarly,
an individual who is a victim of identity theft may mitigate
the damage of identity theft through the placement of a
security freeze on his or her credit report. More broadly,
Californians have a right to privacy under the California
Constitution, and the placement of a security freeze is an
important tool to ensure that sensitive and private
information is not disclosed without one's consent.
However, California law does not enable consumers to place a
security freeze on other, specialty consumer reports. These
reports contain private and sensitive information, including:
information about your medical conditions or
prescriptions that you reported on an application for
health insurance;
information your health insurer has obtained from your
medical provider;
prescription drug purchase histories;
automobile and home insurance claims;
information you provided to a landlord when applying for
housing;
information on returned checks or bankruptcies; and
reports about you made by previous employers.
It is especially important that consumers be able to place
security freezes on these reports as way to prevent identity
theft. The California Office of Privacy Protection has
identified the placement of a security freeze on credit
reports as a way to prevent identity theft: "A security freeze
can help prevent identity theft. Most businesses will not
open credit accounts without first checking a consumer's
credit history. If your credit files are frozen, even someone
who has your name and Social Security number would probably
not be able to get credit in your name."
The same logic applies to specialty consumer reports; by
placing a freeze, an individual can prevent an identity thief
from acquiring insurance, a lease, an occupation or writing
checks in his or her name. Therefore, this legislation would
enable consumers to protect their privacy, and avoid identify
theft, in a more robust way.
SB 1384 (Simitian)
Page 8 of ?
Privacy Rights Clearinghouse supports the bill, writing that
although California permits consumers to freeze their credit
reports, ". . . this right does not currently extend to reports
maintained by these nationwide specialty consumer reporting
agencies. Considering the vast amount of sensitive information
contained in these reports, this is a glaring omission in
California's Consumer Credit Reporting Agencies Act. SB 1384
would rectify this by providing Californians with the right to
'freeze' these reports."
1.Ability of insurer, employer, or landlord to evaluate a
consumer
This bill would extend California's security freeze statute to
permit a consumer to freeze his or her specialty consumer
report. Under the bill, consumers would be able to freeze their
reports relating to any of the following: (1) medical records
or payments; (2) residential or tenant history; (3) check
writing history; (4) employment history; or (5) insurance
claims.
The author asserts that permitting consumers to freeze these
specialty reports will help prevent an identity thief from
acquiring insurance, a lease, or an occupation, or writing
checks in the consumer's name. The author writes, ". . . if an
insurer cannot access your claim history because there is a
freeze on it, then the insurer will refuse to provide insurance
and no fraud could occur. . . . By freezing your specialty
consumer reports, you ensure that identity thieves cannot obtain
insurance, a job, or an apartment in your name, even if they
have enough information to fill out a fraudulent application."
As noted above in the Background, both the Federal Reserve Bank
of Boston and the Federal Trade Commission have acknowledged
this kind of identity theft. Many supporters of the measure
also echo this point, writing:
SB 1384 (Simitian)
Page 9 of ?
In the same way businesses use credit reports to evaluate
applications for credit, businesses use specialty consumer
reports to evaluate applications for rental properties, jobs,
and medical, auto and home insurance. Thus, by placing a
security freeze on these reports, a victim of identity theft
can ensure that other individuals do not obtain insurance,
rental properties or jobs in their name.
This bill is opposed by several companies that compile and
maintain specialty consumer reports as well as a number of
entities that use those reports. In a joint letter, the groups
write:
SB 1384 is misguided because it would allow individuals
intending to commit fraud to freeze his or her criminal
conduct, bounced checks, evictions, or other fraud. This bill
would deny a business from the information they need to make
critical risk decisions. As an example, financial
institutions, which are required by federal and state law to
maintain safe and sound financial practices, would have a
diminished ability to manage risk by having consumers appear
to be better risks than they actually are. In short, SB 1384
actually encourages more fraud, not reduces fraud.
Experian, which provides tenant screening services, writes
"�m]ost consumers would agree that renting to an arsonist,
hiring a violent ex-con as a security guard, insuring an
insurance fraudster, and taking checks from a habitual check
bouncer are all bad outcomes that pose financial and physical
risks to businesses, consumers, common tenants, and co-workers."
LexisNexis Risk Solutions, which provides employment,
residential, healthcare, and volunteer background checks, writes
that the bill "would require extending the 'credit security
freeze' to reports which have no credit data, are not used for
credit-granting purposes, and many of which are used for fraud
prevention and public safety purposes. . . . Thus, to
legislate a freeze capability for non-credit consumer files
would allow the fraud prevention tool to become a fraud enabling
tool. The only reason a consumer would want or need to freeze
non-credit consumer information, like a C.L.U.E. report or their
criminal history is to commit insurance fraud, or to hide
nefarious information. Otherwise, these reports have no value
to identity thieves for credit or financial information."
In response to these arguments, the author writes:
SB 1384 (Simitian)
Page 10 of ?
This legislation does not enable fraud; it is specifically
designed to provide consumers with a tool to prevent fraud.
The coalition contends that an individual who intends to
commit fraud will freeze his or her specialty consumer report.
Then, when a business goes to check the fraudster's history,
the business will not see the track record of fraud. However,
when a business fails to verify a customer's history, they do
not provide services to the customer; that's the point of
security freezes.
The opposition would have you believe that when a business -
who is paying to access a customer's history - is unable to
access it, then the business provides the service anyway.
This is implausible. Instead, this bill helps consumers
prevent fraud. Imagine, for example, that an identity thief
has stolen enough of your information to fill out a fraudulent
application for an apartment, job, or insurance in your name.
If you were to place a security freeze on your specialty
consumer reports, then the landlord, employer, or insurer
would be unable to check the fraudulent applicant's history,
and would refuse to provide the service.
It comes down to this: if a business attempts to check your
history and runs into a security freeze, does the business:
A) Ignore the lack of information that it pays to access, and
provide the service anyway; or B) Refuse service until it can
verify your history. If B, then this bill prevents fraud.
In addition, staff notes that existing law expressly permits a
third party who requests access to a consumer's credit report in
connection with an application for credit or any other use to
treat that application as incomplete if a security freeze is in
place and the consumer does not allow access to his or her
report for the specific party or period of time. In addition,
as discussed in Comment 4, public record information-such as
criminal convictions and other publicly available criminal
history information-contained in a credit report may not be
frozen.
2.Several states already permit consumers to freeze some
specialty consumer reports
Permitting consumers to freeze their specialty consumer reports
is not unprecedented. Six states and the District of Columbia
currently allow consumers to place a security freeze on some
SB 1384 (Simitian)
Page 11 of ?
specialty consumer reports. In fact, LexisNexis Risk Solutions,
which is not a credit reporting agency and does not maintain
credit files, alerts consumers in these states to this fact,
noting "�a]s a consumer, and depending on the state of your
residency, you may be able to request that a security freeze be
placed on certain data that LexisNexis Risk Solutions maintains
about you, including some or all of the following: C.L.U.E.
reports . . . employment screening reports, and resident
screening reports." (See
https://personalreports.lexisnexis.com/freeze.jsp.)
The website then indicates that consumers can request that a
security freeze be placed on employment and resident reports in
Colorado, Delaware, Maine, New Hampshire, New Jersey, North
Carolina and the District of Columbia. In Maine and New Jersey,
consumers can also freeze their C.L.U.E. reports. (Id.)
3.Disclosure of public record information still permitted
Under existing law, regardless of the existence of a security
freeze, a consumer reporting agency may disclose public record
information lawfully obtained by the agency from an open public
record to the extent otherwise permitted by law. This would
include public record information such as criminal convictions
or other publicly available criminal history information. This
bill would extend these provisions to nationwide specialty
credit reporting agencies. As a result, the author asserts that
the bill "would not permit someone to freeze their history of
criminal conduct."
4.Existing consumer protections under state and federal law
LexisNexis Risk Solutions asserts that this bill "is unnecessary
because sufficient consumer protections already exist under
federal and California law." On this point, the company writes:
. . . existing federal and California law contain existing
protections for the accuracy and privacy of non-credit
consumer files, rendering the provisions of SB 1384
unnecessary. Under the federal Fair Credit Reporting Act
(FCRA), consumer reporting agencies are required to maintain
reasonable procedures to maintain the maximum possible
accuracy of consumer files. Entities furnishing data to
consumer reporting agencies cannot supply information that
they believe to be inaccurate, and they have a duty to correct
and update information. Consumers have the right to dispute
SB 1384 (Simitian)
Page 12 of ?
information in their credit reports with consumer reporting
agencies. . . . The FCRA also specifically governs the use
of consumer reports for employment purposes by requiring a
prospective employee �to] receive written disclosure and give
consent to an employer seeking to obtain a consumer report for
employment purposes. . . . Accordingly, existing federal and
California law strikes the right balance of allowing
"nationwide specialty consumer reporting agencies" to
sufficiently guard against fraud, while sufficiently
protecting consumer privacy, making SB 1384 unnecessary.
The author responds that LexisNexis' contention that existing
law contains sufficient protections for the accuracy and privacy
of non-credit consumer files is "correct, and that's why this
legislation does not contain provisions that require specialty
consumer reporting agencies to take new measures regarding the
accuracy of their files, or to alter to whom they disclose their
records. Instead, it merely requires that consumers be given
the option to control when third parties can access their
consumer file. A specialty consumer reporting agency can
provide accurate information, to a legitimate party, and still
unknowingly facilitate identity theft. We don't expect
specialty consumer reporting agencies to stop identity theft,
but we do expect them to accommodate a consumer's request to
freeze that information."
5.Bill would not affect ability of entity which has an existing
account with consumer to evaluate that consumer
Under this bill, a consumer would be permitted to freeze his or
her specialty consumer report. Existing law currently provides
that the security freeze statute does not apply to the use of a
credit report by a person or entity with whom the consumer has
or had an account or contract for the purpose of reviewing the
account or collecting the financial obligation owed on the
account or contract. "Reviewing the account" is defined to
include activities related to account maintenance, monitoring,
credit line increases, and account upgrades and enhancements.
As a result, under this bill, an entity that currently has an
account with a consumer who has frozen his or her specialty
credit report would still be able to access that report.
7. Check verification services already exempted under existing
law
This bill would define a "nationwide specialty consumer
SB 1384 (Simitian)
Page 13 of ?
reporting agency" to include a consumer reporting agency that
compiles and maintains files on consumers on a nationwide basis
relating to check writing history. Under existing law, a check
services or fraud prevention services company which issues
reports on incidents of fraud or authorizations for the purpose
of approving or processing checks, electronic funds transfers,
or similar methods of payments is not required to place a
security freeze on a consumer's credit report. (Civ. Code Sec.
1785.11.6.)
First Data Corporation has an "oppose unless amended" position
on this bill. Its subsidiary, TeleCheck, a check verification
company, provides real-time verification to merchants concerning
a consumer's check writing history in an effort to help the
merchant determine whether or not to accept a particular
consumer's check. First Data indicates that "TeleCheck does not
provide businesses with account balances or other personal
information about the check writer. Instead, the business
simply receives an assessment code and can use that code to make
a decision about accepting or rejecting the check." Under this
bill, TeleCheck could not release the information of a consumer
who had frozen his or her report. In support of its position,
First Data writes:
By subjecting check verification companies to the purview of
SB 1384, it either gives criminals carte blanche to perpetrate
check fraud, or it will significantly disadvantage retailers
in the state by removing the only fraud prevention tool they
have at the point of sale when deciding to accept a check.
In addition, because existing law currently exempts check
verification companies like TeleCheck, if enacted, this bill may
cause uncertainty on this point. As a result, the Committee may
wish to address this issue and delete "Check writing history"
from the bill, consistent with existing law.
8. Technical amendments needed
The following technical amendments are needed:
Technical amendments :
On page 3, line 34, after "he" insert "or she"
On page 5, line 38, after "enforce" insert ","
SB 1384 (Simitian)
Page 14 of ?
On page 7, line 15, strike "fax" and insert "facsimile"
On page 10, line 25, strike "or nationwide specialty consumer
reporting agency"
On page 10, line 27, strike "or consumer file"
Support : American Federation of State, County and Municipal
Employees (AFSCME), AFL-CIO; California Alliance for Retired
Americans; California Public Interest Research Group (CALPIRG);
California School Employees Association, AFL-CIO; California
State Sheriffs' Association; Congress of California Seniors;
Consumer Federation of California; Consumers Union; Consumer
Watchdog; Older Women's League of California; Privacy Rights
Clearinghouse
Opposition : Apartment Association of Greater Los Angeles;
Association of California Insurance Companies; Association of
California Life & Health Insurance Companies; CalChamber;
California Association of Collectors, Inc.; California Bankers
Association; California Retailers Association; Consumer Data
Industry Association; Experian; First Data Corporation (unless
amended); LexisNexis Risk Solutions; National Association of
Mutual Insurance Companies; Pacific Association of Domestic
Insurance Companies;
Personal Insurance Federation of California; Reed Elsevier; San
Diego County Apartment Association; Santa Barbra Rental Property
Association; State Privacy and Security Coalition; TechAmerica
HISTORY
Source : An individual
Related Pending Legislation : None Known
Prior Legislation : SB 168 (Bowen, Ch. 720, Stats. 2001) See
Background.
**************