BILL ANALYSIS �
------------------------------------------------------------
|SENATE RULES COMMITTEE | SB 1384|
|Office of Senate Floor Analyses | |
|1020 N Street, Suite 524 | |
|(916) 651-1520 Fax: (916) | |
|327-4478 | |
------------------------------------------------------------
THIRD READING
Bill No: SB 1384
Author: Simitian (D)
Amended: 5/15/12
Vote: 21
SENATE JUDICIARY COMMITTEE : 3-2, 5/8/12
AYES: Evans, Corbett, Leno
NOES: Harman, Blakeslee
SUBJECT : Consumer information privacy
SOURCE : Author
DIGEST : This bill allows a consumer to freeze his/her
specialty consumer report, defined to mean reports relating
to the consumer's medical records, residential or tenant
history, employment history, or insurance claims.
ANALYSIS : Existing federal law defines "nationwide
specialty consumer reporting agency" to mean a consumer
reporting agency that compiles and maintains files on
consumers on a nationwide basis relating to medical records
or payments, residential or tenant history, check writing
history, employment history, or insurance claims. (15
U.S.C. Section 1681a)
Existing federal law requires specialty consumer reporting
agencies to give consumers one free report each year upon
request. (15 U.S.C. Section 1681j)
CONTINUED
SB 1384
Page
2
Existing law permits a consumer to place a "security
freeze" on his/her credit report, prohibiting consumer
credit reporting agencies from releasing the consumer's
credit report or any information contained in it unless the
consumer expressly authorizes the release. (Civil Code
(CIV) Section 1785.11.2(a))
Existing law requires a credit reporting agency to place a
security freeze on a consumer's credit report within three
business days after receiving the consumer's request. (CIV
Section 1785.11.2(b))
Existing law requires a credit reporting agency to send a
written confirmation of the security freeze to the consumer
within 10 business days. The credit reporting agency must
also provide the consumer with a unique personal
identification number or password to be used by the
consumer when he or she authorizes the release of his/her
information for a specific party or period of time. (CIV
Section 1785.11.2(c))
Existing law permits a consumer to allow his/her credit
report to be accessed for a specific party or period of
time while a freeze is in place and requires the consumer
to provide specified information to the credit reporting
agency so that the freeze may be temporarily lifted. (CIV
Section 1785.11.2(d))
Existing law requires a credit reporting agency that
receives a consumer's request to temporarily lift a freeze
to comply with that request within three business days.
(CIV Section 1785.11.2(e))
Existing law requires a credit reporting agency to develop
procedures involving telephone, fax, the Internet, or other
electronic media to receive and process a consumer's
request to temporarily lift a freeze in an expedited
manner. (CIV Section 1785.11.2(f))
Existing law provides that a credit reporting agency may
remove or temporarily lift a freeze only upon the
consumer's request or if the consumer's credit report was
frozen due to a material misrepresentation of fact by the
consumer, in which case the credit reporting agency must
CONTINUED
SB 1384
Page
3
notify the consumer before removing the freeze. (CIV
Section 1785.11.2(g))
Existing law specifies that a third party who requests
access to a consumer's credit report in connection with an
application for credit or any other use may treat that
application as incomplete if a security freeze is in place
and the consumer does not allow access to his or her report
for the specific party or period of time. (CIV Section
1785.11.2(h))
Existing law requires a credit reporting agency to disclose
to a consumer who has requested a freeze the process of
placing and temporarily lifting the freeze and the process
for allowing access to the consumer's information for a
specific party or period of time while the freeze is in
effect. (CIV Section 1785.11.2(i))
Existing law requires that a security freeze must remain in
place until the consumer requests that it be removed. If a
consumer requests that the freeze be removed, a credit
reporting agency must comply with that request within three
business days of receiving the request for removal, and the
consumer must provide specified information. (CIV Section
1785.11.2(j).) Existing law provides that a credit
reporting agency must require proper identification, as
defined, of a consumer making a request to place or remove
a security freeze. (CIV Section 1785.11.2(k))
Existing law provides that the security freeze statute does
not apply to the use of a credit report by any of the
following: (1) a person or entity with whom the consumer
has or had an account, as specified; (2) a state or local
agency, law enforcement agency, trial court, or private
collection agency acting pursuant to a court order,
warrant, or subpoena; (3) a child support agency; (4) the
Department of Health Care Services when investigating
Medi-Cal fraud; (5) the Franchise Tax Board when
investigating or collecting delinquent taxes or unpaid
court orders; (6) the use of credit information for
prescreening, as specified; (7) a credit monitoring service
to which the consumer has subscribed; and (8) a person or
entity when providing the consumer a copy of his or her own
credit report. (CIV Section 1785.11.2(l))
CONTINUED
SB 1384
Page
4
Existing law permits a credit reporting agency to charge a
fee of no more than $10 for placing, removing, or
temporarily lifting a freeze. A credit reporting agency
may not charge a fee to an identity theft victim, and may
charge a fee of no more than $5 to a consumer who is 65
years of age and older. (CIV Section 1785.11.2(m))
Existing law provides that, regardless of the existence of
a security freeze, a consumer reporting agency may disclose
public record information lawfully obtained by the agency
from an open public record to the extent otherwise
permitted by law. (CIV Section 1785.11.2(n))
Existing law provides that, if a security freeze is in
place, a credit reporting agency may not change any of the
following official information without notifying the
consumer within 30 days of the change being made to the
consumer's file: name, date of birth, Social Security
number, and address. (CIV Section 1785.11.3(a))
This bill applies all of the above state law provisions to
"nationwide specialty consumer reporting agencies."
This bill defines a "nationwide specialty consumer
reporting agency" to mean a consumer reporting agency that
compiles and maintains files on consumers on a nationwide
basis relating to any of the following: medical records or
payments, residential or tenant history, employment
history, or insurance claims.
Background
According to the Federal Trade Commission's (FTC) "Consumer
Sentinel Network Data Book for January-December 2010,"
California had more identity theft complaints - 38,148 -
than any other state. For every 100,000 people in
California, there were 102.4 identity theft complaints, and
only Florida and Arizona had more complaints per capita.
Three of the top 10 largest metropolitan areas with the
highest per capita rates of identity theft complaints were
in California: Madera, Merced, and Bakersfield. (FTC,
Consumer Sentinel Network Data Book for January - December
2010 (Mar. 2011)
CONTINUED
SB 1384
Page
5
�as of May 5, 2012])
Identity theft victims' information can be misused in
numerous ways. One of the most common is the creation of
new accounts, including credit card, utility, or wireless
telephone accounts. But, victims' information can also be
used in other, equally nefarious ways. For example,
according to the Federal Reserve Bank of Boston, some
identity theft victims have reported that identity thieves
used their information to apply for apartments or print
counterfeit checks in their names. (Federal Reserve Bank
of Boston, Identity Theft (Nov. 2005)
�as
of May 5, 2012].) And, the FTC notes that "�o]nce they
have your personal information, identity thieves use it in
a variety of ways. ... They may get a job using your
Social Security number. They may rent a house or get
medical services using your name. ? You may find out when
you get something in the mail about an apartment you never
rented ? or a job you never held." (FTC, Fighting Back
Against Identity Theft, �as of May 5, 2012])
A credit report is a consumer's credit history compiled by
a credit reporting agency. The report contains information
such as annual income, outstanding debt, bill-paying
history, the number, types, and age of accounts, current
and previous addresses, and Social Security number. Under
federal law, a credit reporting agency may disclose
information contained in a credit report to current and
prospective creditors, insurers, employers (provided the
consumer has authorized the disclosure), and others who
have a "legitimate business need" in connection with a
business transaction initiated by the consumer. (15 U.S.C.
Section 1681b.) Federal law requires consumer reporting
agencies to give consumers one free credit report each
year. (15 U.S.C. Section 1681j)
Increasingly, employers, insurers, landlords, and others
are using "specialized" consumer reports to evaluate a
consumer's risk for employment, insurance, and rental
housing. Under federal law, these "specialty consumer
CONTINUED
SB 1384
Page
6
reporting agencies" compile and maintain consumer files
relating to medical records or payments, residential or
tenant history, check writing history, employment history,
or insurance claims. (15 U.S.C. Section 1681a.) Federal
law requires specialty consumer reporting agencies to give
consumers one free report each year. (15 U.S.C. Sec.
1681j.) California's Investigative Consumer Reporting
Agencies Act also regulates specialized consumer reports
and contains requirements related to accuracy and
confidentiality of reports. (CIV Section 1786 et seq.)
Specialty consumer reports are often tailored to the
particular users of the reports. For example, insurers use
the Comprehensive Loss Underwriting Exchange, more commonly
known as "C.L.U.E.," when they are underwriting or rating
an insurance policy. The C.L.U.E. database contains
information relating to a consumer's claims history. Some
consumers' medical information is also compiled by
specialty consumer reporting agencies. For instance,
records of individual life, health, long-term care, and
disability insurance are maintained in the Medical
Information Bureau, and other databases contain information
concerning consumers' prescription drug purchase histories.
Landlords use specialized tenant screening reports, which
contain rental payment data to evaluate prospective
tenants, and several companies report on consumers' check
writing history. Employers also use specialized background
screening reports, although they must get the consumer's
written authorization before doing so. (See Privacy Rights
Clearinghouse, Other Consumer Reports: What You Should Know
about 'Specialty' Reports, (Apr. 2012)
�as
of May 5, 2012])
In 2001, California became the first state to give
consumers the right to place a freeze on their credit
reports, which prohibits a credit reporting agency from
releasing the consumer's credit report without the express
authorization of the consumer. (See SB 168 (Bowen, Chapter
720, Statutes of 2001).) Since that time, 46 other states
and the District of Columbia have followed California's
lead and enacted security freeze legislation, limiting
disclosure of consumers' credit reports. Six of those
states and the District of Columbia allow consumers to
CONTINUED
SB 1384
Page
7
place a security freeze on some specialty consumer reports
as well. For example, consumers can request that a
security freeze be placed on employment and resident
reports in Colorado, Delaware, Maine, New Hampshire, New
Jersey, North Carolina and the District of Columbia. In
Maine and New Jersey, consumers can also freeze their
C.L.U.E. reports.
FISCAL EFFECT : Appropriation: No Fiscal Com.: No
Local: No
SUPPORT : (Verified 5/23/12)
American Federation of State, County and Municipal
Employees, AFL-CIO
California Alliance for Retired Americans
California Public Interest Research Group
California School Employees Association, AFL-CIO
California Senior Legislature
Congress of California Seniors
Consumer Federation of California
Consumer Watchdog
Consumers Union
Older Women's League of California
Peace Officers Research Association of California
Privacy Rights Clearinghouse
OPPOSITION : (Verified 5/16/12)
Apartment Association of Greater Los Angeles
Association of California Insurance Companies
Association of California Life & Health Insurance Companies
California Association of Collectors, Inc.
California Bankers Association
California Chamber of Commerce
California Retailers Association
Consumer Data Industry Association
Experian
LexisNexis Risk Solutions
National Association of Mutual Insurance Companies
Pacific Association of Domestic Insurance Companies
Personal Insurance Federation of California
Reed Elsevier
San Diego County Apartment Association
CONTINUED
SB 1384
Page
8
Santa Barbra Rental Property Association
State Privacy and Security Coalition
TechAmerica
ARGUMENTS IN SUPPORT : According to the author:
Senate Bill 1384 combats identity theft by enabling
consumers to place a security freeze on their specialty
consumer reports. These reports contain information on
consumer's medical conditions, drug prescriptions, tenant
history, employment, and insurance claims.
Existing California law passed in 2001 (SB 168, Bowen)
permits consumers to place a "security freeze" on their
credit reports. When a consumer places a security freeze
on his or her credit report, the reporting agency is
prohibited from releasing the consumer's report, or any
information from it, without the express authorization of
the consumer. This helps combat identity theft.
According to the California Office of Privacy Protection,
"Most businesses will not open credit accounts without
first checking a consumer's credit history. If your
credit files are frozen, even someone who has your name
and Social Security number would probably not be able to
get credit in your name."
This bill helps prevent identity theft in the same way.
In addition, there are several cases where consumer
reporting agencies have unknowingly distributed sensitive
specialty consumer reports to fraudsters disguised as
legitimate businesses. This has led to thousands of
cases of identity theft.
By placing a security freeze on specialty consumer
reports, and removing it as necessary, consumers can
protect themselves from this sort of identity theft. A
security freeze ensures that businesses only access this
sensitive information when there is a legitimate
application for services.
ARGUMENTS IN OPPOSITION : LexisNexis Risk Solutions,
which provides employment, residential, healthcare, and
volunteer background checks, writes that the bill "would
require extending the 'credit security freeze' to reports
CONTINUED
SB 1384
Page
9
which have no credit data, are not used for credit-granting
purposes, and many of which are used for fraud prevention
and public safety purposes. ? Thus, to legislate a freeze
capability for non-credit consumer files would allow the
fraud prevention tool to become a fraud enabling tool. The
only reason a consumer would want or need to freeze
non-credit consumer information, like a C.L.U.E. report or
their criminal history is to commit insurance fraud, or to
hide nefarious information. Otherwise, these reports have
no value to identity thieves for credit or financial
information."
JJA:mw 5/24/12 Senate Floor Analyses
SUPPORT/OPPOSITION: SEE ABOVE
**** END ****
CONTINUED