BILL ANALYSIS �
------------------------------------------------------------
|SENATE RULES COMMITTEE | SB 1384|
|Office of Senate Floor Analyses | |
|1020 N Street, Suite 524 | |
|(916) 651-1520 Fax: (916) | |
|327-4478 | |
------------------------------------------------------------
THIRD READING
Bill No: SB 1384
Author: Simitian (D)
Amended: 5/15/12
Vote: 21
SENATE JUDICIARY COMMITTEE : 3-2, 5/8/12
AYES: Evans, Corbett, Leno
NOES: Harman, Blakeslee
SUBJECT : Consumer information privacy
SOURCE : Author
DIGEST : This bill allows a consumer to freeze his/her
specialty consumer report, defined to mean reports relating
to the consumers medical records, residential or tenant
history, employment history, or insurance claims.
ANALYSIS : Existing federal law defines "nationwide
specialty consumer reporting agency" to mean a consumer
reporting agency that compiles and maintains files on
consumers on a nationwide basis relating to medical records
or payments, residential or tenant history, check writing
history, employment history, or insurance claims. (15
U.S.C. Section 1681a)
Existing federal law requires specialty consumer reporting
agencies to give consumers one free report each year upon
request. (15 U.S.C. Section 1681j)
CONTINUED
SB 1384
Page
2
Existing law permits a consumer to place a "security
freeze" on his/her credit report, prohibiting consumer
credit reporting agencies from releasing the consumer's
credit report or any information contained in it unless the
consumer expressly authorizes the release. (Civil Code
(CIV) Section 1785.11.2(a))
Existing law requires a credit reporting agency to place a
security freeze on a consumer's credit report within three
business days after receiving the consumer's request. (CIV
Section 1785.11.2(b))
Existing law requires a credit reporting agency to send a
written confirmation of the security freeze to the consumer
within 10 business days. The credit reporting agency must
also provide the consumer with a unique personal
identification number or password to be used by the
consumer when he or she authorizes the release of his/her
information for a specific party or period of time. (CIV
Section 1785.11.2(c))
Existing law permits a consumer to allow his/her credit
report to be accessed for a specific party or period of
time while a freeze is in place and requires the consumer
to provide specified information to the credit reporting
agency so that the freeze may be temporarily lifted. (CIV
Section 1785.11.2(d))
Existing law requires a credit reporting agency that
receives a consumer's request to temporarily lift a freeze
to comply with that request within three business days.
(CIV Section 1785.11.2(e))
Existing law requires a credit reporting agency to develop
procedures involving telephone, fax, the Internet, or other
electronic media to receive and process a consumer's
request to temporarily lift a freeze in an expedited
manner. (CIV Section 1785.11.2(f))
Existing law provides that a credit reporting agency may
remove or temporarily lift a freeze only upon the
consumer's request or if the consumer's credit report was
frozen due to a material misrepresentation of fact by the
consumer, in which case the credit reporting agency must
SB 1384
Page
3
notify the consumer before removing the freeze. (CIV
Section 1785.11.2(g))
Existing law specifies that a third party who requests
access to a consumer's credit report in connection with an
application for credit or any other use may treat that
application as incomplete if a security freeze is in place
and the consumer does not allow access to his or her report
for the specific party or period of time. (CIV Section
1785.11.2(h))
Existing law requires a credit reporting agency to disclose
to a consumer who has requested a freeze the process of
placing and temporarily lifting the freeze and the process
for allowing access to the consumer's information for a
specific party or period of time while the freeze is in
effect. (CIV Section 1785.11.2(i))
Existing law requires that a security freeze must remain in
place until the consumer requests that it be removed. If a
consumer requests that the freeze be removed, a credit
reporting agency must comply with that request within three
business days of receiving the request for removal, and the
consumer must provide specified information. (CIV Section
1785.11.2(j).) Existing law provides that a credit
reporting agency must require proper identification, as
defined, of a consumer making a request to place or remove
a security freeze. (CIV Section 1785.11.2(k))
Existing law provides that the security freeze statute does
not apply to the use of a credit report by any of the
following: (1) a person or entity with whom the consumer
has or had an account, as specified; (2) a state or local
agency, law enforcement agency, trial court, or private
collection agency acting pursuant to a court order,
warrant, or subpoena; (3) a child support agency; (4) the
Department of Health Care Services when investigating
Medi-Cal fraud; (5) the Franchise Tax Board when
investigating or collecting delinquent taxes or unpaid
court orders; (6) the use of credit information for
prescreening, as specified; (7) a credit monitoring service
to which the consumer has subscribed; and (8) a person or
entity when providing the consumer a copy of his or her own
credit report. (CIV Section 1785.11.2(l))
SB 1384
Page
4
Existing law permits a credit reporting agency to charge a
fee of no more than $10 for placing, removing, or
temporarily lifting a freeze. A credit reporting agency
may not charge a fee to an identity theft victim, and may
charge a fee of no more than $5 to a consumer who is 65
years of age and older. (CIV Section 1785.11.2(m))
Existing law provides that, regardless of the existence of
a security freeze, a consumer reporting agency may disclose
public record information lawfully obtained by the agency
from an open public record to the extent otherwise
permitted by law. (CIV Section 1785.11.2(n))
Existing law provides that, if a security freeze is in
place, a credit reporting agency may not change any of the
following official information without notifying the
consumer within 30 days of the change being made to the
consumer's file: name, date of birth, Social Security
number, and address. (CIV Section 1785.11.3(a))
This bill applies all of the above state law provisions to
"nationwide specialty consumer reporting agencies."
This bill defines a "nationwide specialty consumer
reporting agency" to mean a consumer reporting agency that
compiles and maintains files on consumers on a nationwide
basis relating to any of the following: medical records or
payments, residential or tenant history, employment
history, or insurance claims.
Background
According to the Federal Trade Commission's (FTC) "Consumer
Sentinel Network Data Book for January-December 2010,"
California had more identity theft complaints - 38,148 -
than any other state. For every 100,000 people in
California, there were 102.4 identity theft complaints, and
only Florida and Arizona had more complaints per capita.
Three of the top 10 largest metropolitan areas with the
highest per capita rates of identity theft complaints were
in California: Madera, Merced, and Bakersfield. (FTC,
Consumer Sentinel Network Data Book for January - December
2010 (Mar. 2011)
SB 1384
Page
5
�as of May 5, 2012])
Identity theft victims' information can be misused in
numerous ways. One of the most common is the creation of
new accounts, including credit card, utility, or wireless
telephone accounts. But, victims' information can also be
used in other, equally nefarious ways. For example,
according to the Federal Reserve Bank of Boston, some
identity theft victims have reported that identity thieves
used their information to apply for apartments or print
counterfeit checks in their names. (Federal Reserve Bank
of Boston, Identity Theft (Nov. 2005)
�as
of May 5, 2012].) And, the FTC notes that "�o]nce they
have your personal information, identity thieves use it in
a variety of ways. ... They may get a job using your
Social Security number. They may rent a house or get
medical services using your name. ? You may find out when
you get something in the mail about an apartment you never
rented ? or a job you never held." (FTC, Fighting Back
Against Identity Theft, �as of May 5, 2012])
A credit report is a consumer's credit history compiled by
a credit reporting agency. The report contains information
such as annual income, outstanding debt, bill-paying
history, the number, types, and age of accounts, current
and previous addresses, and Social Security number. Under
federal law, a credit reporting agency may disclose
information contained in a credit report to current and
prospective creditors, insurers, employers (provided the
consumer has authorized the disclosure), and others who
have a "legitimate business need" in connection with a
business transaction initiated by the consumer. (15 U.S.C.
Section 1681b.) Federal law requires consumer reporting
agencies to give consumers one free credit report each
year. (15 U.S.C. Section 1681j)
Increasingly, employers, insurers, landlords, and others
are using "specialized" consumer reports to evaluate a
consumer's risk for employment, insurance, and rental
housing. Under federal law, these "specialty consumer
SB 1384
Page
6
reporting agencies" compile and maintain consumer files
relating to medical records or payments, residential or
tenant history, check writing history, employment history,
or insurance claims. (15 U.S.C. Section 1681a.) Federal
law requires specialty consumer reporting agencies to give
consumers one free report each year. (15 U.S.C. Sec.
1681j.) California's Investigative Consumer Reporting
Agencies Act also regulates specialized consumer reports
and contains requirements related to accuracy and
confidentiality of reports. (CIV Section 1786 et seq.)
Specialty consumer reports are often tailored to the
particular users of the reports. For example, insurers use
the Comprehensive Loss Underwriting Exchange, more commonly
known as "C.L.U.E.," when they are underwriting or rating
an insurance policy. The C.L.U.E. database contains
information relating to a consumer's claims history. Some
consumers' medical information is also compiled by
specialty consumer reporting agencies. For instance,
records of individual life, health, long-term care, and
disability insurance are maintained in the Medical
Information Bureau, and other databases contain information
concerning consumers' prescription drug purchase histories.
Landlords use specialized tenant screening reports, which
contain rental payment data to evaluate prospective
tenants, and several companies report on consumers' check
writing history. Employers also use specialized background
screening reports, although they must get the consumer's
written authorization before doing so. (See Privacy Rights
Clearinghouse, Other Consumer Reports: What You Should Know
about 'Specialty' Reports, (Apr. 2012)
�as
of May 5, 2012])
In 2001, California became the first state to give
consumers the right to place a freeze on their credit
reports, which prohibits a credit reporting agency from
releasing the consumer's credit report without the express
authorization of the consumer. (See SB 168 (Bowen, Chapter
720, Statutes of 2001).) Since that time, 46 other states
and the District of Columbia have followed California's
lead and enacted security freeze legislation, limiting
disclosure of consumers' credit reports. Six of those
states and the District of Columbia allow consumers to
SB 1384
Page
7
place a security freeze on some specialty consumer reports
as well. For example, consumers can request that a
security freeze be placed on employment and resident
reports in Colorado, Delaware, Maine, New Hampshire, New
Jersey, North Carolina and the District of Columbia. In
Maine and New Jersey, consumers can also freeze their
C.L.U.E. reports.
FISCAL EFFECT : Appropriation: No Fiscal Com.: No
Local: No
SUPPORT : (Verified 5/16/12)
American Federation of State, County and Municipal
Employees, AFL-CIO
California Alliance for Retired Americans
California Public Interest Research Group
California School Employees Association, AFL-CIO
California State Sheriffs' Association
Congress of California Seniors
Consumer Federation of California
Consumer Watchdog
Consumers Union
Older Women's League of California
Privacy Rights Clearinghouse
OPPOSITION : (Verified 5/16/12)
Apartment Association of Greater Los Angeles
Association of California Insurance Companies
Association of California Life & Health Insurance Companies
California Association of Collectors, Inc.
California Bankers Association
California Chamber of Commerce
California Retailers Association
Consumer Data Industry Association
Experian
LexisNexis Risk Solutions
National Association of Mutual Insurance Companies
Pacific Association of Domestic Insurance Companies
Personal Insurance Federation of California
Reed Elsevier
San Diego County Apartment Association
Santa Barbra Rental Property Association
SB 1384
Page
8
State Privacy and Security Coalition
TechAmerica
ARGUMENTS IN SUPPORT : The author writes:
An individual may want to place a security freeze on his
or her credit report to prevent credit, loans, and
services from being approved in his or her name without
consent. Similarly, an individual who is a victim of
identity theft may mitigate the damage of identity theft
through the placement of a security freeze on his or her
credit report. More broadly, Californians have a right
to privacy under the California Constitution, and the
placement of a security freeze is an important tool to
ensure that sensitive and private information is not
disclosed without one's consent.
However, California law does not enable consumers to
place a security freeze on other, specialty consumer
reports. These reports contain private and sensitive
information, including:
information about your medical conditions or
prescriptions that you reported on an application for
health insurance;
information your health insurer has obtained from
your medical provider;
prescription drug purchase histories;
automobile and home insurance claims;
information you provided to a landlord when
applying for housing;
information on returned checks or bankruptcies; and
reports about you made by previous employers.
It is especially important that consumers be able to
place security freezes on these reports as way to prevent
identity theft. The California Office of Privacy
Protection has identified the placement of a security
SB 1384
Page
9
freeze on credit reports as a way to prevent identity
theft: "A security freeze can help prevent identity
theft. Most businesses will not open credit accounts
without first checking a consumer's credit history. If
your credit files are frozen, even someone who has your
name and Social Security number would probably not be
able to get credit in your name."
The same logic applies to specialty consumer reports; by
placing a freeze, an individual can prevent an identity
thief from acquiring insurance, a lease, an occupation or
writing checks in his or her name. Therefore, this
legislation would enable consumers to protect their
privacy, and avoid identify theft, in a more robust way.
ARGUMENTS IN OPPOSITION : LexisNexis Risk Solutions,
which provides employment, residential, healthcare, and
volunteer background checks, writes that the bill "would
require extending the 'credit security freeze' to reports
which have no credit data, are not used for credit-granting
purposes, and many of which are used for fraud prevention
and public safety purposes. ? Thus, to legislate a freeze
capability for non-credit consumer files would allow the
fraud prevention tool to become a fraud enabling tool. The
only reason a consumer would want or need to freeze
non-credit consumer information, like a C.L.U.E. report or
their criminal history is to commit insurance fraud, or to
hide nefarious information. Otherwise, these reports have
no value to identity thieves for credit or financial
information."
JJA:mw 5/16/12 Senate Floor Analyses
SUPPORT/OPPOSITION: SEE ABOVE
**** END ****