Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person, as defined, who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person.

This bill would, until January 1, 2021, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept an electronic acknowledgment verifying the identity of the applicant using a multilayered remote identity proofing process. If an applicants identity cannot be established electronically, the bill would require the applicant to include with his or her request a statement of identity notarized pursuant to existing law. The bill would require the verification to comply with specified provisions and protect the personal information of the applicant and guard against identity theft. The bill would require the State Registrar and any city or county that fulfills electronic requests without a notarized statement of identity to report to the Attorney General and the Legislature on or before January 1, 2019, regarding the number and types of requests and the availability of consumer protection mechanisms, as specified.

This bill would authorize the State Department of Public Health to implement its procedures relating to electronic verification through an all-county letter or similar instruction from the State Registrar without taking regulatory action. The bill would specifically authorize the department to accept an electronic verification of identity accompanied by an electronic statement sworn under penalty of perjury for the above purposes. By expanding the crime of perjury, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person, as defined, who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person.

This bill would, until January 1, 2021, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept an electronic acknowledgment verifying the identity of the applicant using a multilayered remote identity proofing process. If an applicants identity cannot be established electronically, the bill would require the applicant to include with his or her request a statement of identity notarized pursuant to existing law. The bill would require the verification to comply with specified provisions and protect the personal information of the applicant and guard against identity theft. The bill would require the State Registrar and any city or county that fulfills electronic requests without a notarized statement of identity to report to the Attorney General and the Legislature on or before January 1, 2019, regarding the number and types of requests and the availability of consumer protection mechanisms, as specified.

This bill would authorize the State Department of Public Health to implement its procedures relating to electronic verification through an all-county letter or similar instruction from the State Registrar without taking regulatory action. The bill would specifically authorize the department to accept an electronic verification of identity accompanied by an electronic statement sworn under penalty of perjury for the above purposes. By expanding the crime of perjury, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person, as defined, who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person.

This bill would, until January 1, 2021, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept an electronic acknowledgment verifying the identity of the applicant using a multilayered remote identity proofing process. If an applicants identity cannot be established electronically, the bill would require the applicant to include with his or her request a statement of identity notarized pursuant to existing law. The bill would require the verification to comply with specified provisions and protect the personal information of the applicant and guard against identity theft. The bill would require a the State Registrar and any city or county that fulfills electronic requests without a notarized statement of identity to report to the Attorney General and the Legislature on or before January 1, 2019, regarding the number and types of requests and the availability of consumer protection mechanisms, as specified.

Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person, as defined, who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person.

This bill would, until January 1, 2021, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept an electronic acknowledgment verifying the identity of the applicant using a multilayered remote identity proofing process that includes guidelines for security and privacy, and satisfying other specified requirements, ensuring that the applicant is an authorized person. process. If an applicants identity cannot be established electronically, the applicant shall bill would require the applicant to include with his or her request a statement of identity notarized pursuant to existing law. The bill would require the verification to comply with specified provisions and protect the personal information of the applicant and guard against identity theft. The bill would require a city or county that fulfills electronic requests without a notarized statement of identity to report to the Attorney General and the Legislature on or before January 1, 2019, regarding the number and types of requests and the availability of consumer protection mechanisms, as specified.

Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person, as defined, who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person.

This bill would, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept electronic acknowledgment verifying the identity of the requester applicant using a multilayered remote identity proofing process aligned with federal that includes guidelines for security and privacy, and satisfying other specified requirements, ensuring that the requester applicant is an authorized person. If an applicants identity cannot be established electronically, the applicant shall include with his or her request a statement of identity notarized pursuant to existing law. The bill would require the verification to comply with specified provisions and protect the personal information of the requester applicant and guard against identity theft.

Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person, as defined, who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person.

This bill would, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept electronic acknowledgment verifying the identity of the requester using a remote identity proofing process aligned with federal guidelines for security and privacy, and satisfying other specified requirements, ensuring that the requester is an authorized person. The bill would require the verification to comply with specified provisions and protect the personal information of the requester and guard against identity theft.

Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person, as defined, who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person.

This bill would, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept electronic acknowledgment verifying the identity of the requester using a remote identity proofing process aligned with federal guidelines for security and privacy, and satisfying other specified requirements, ensuring that the requester is an authorized person. The bill would require the verification to comply with specified provisions and protect the personal information of the requester and guard against identity theft.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 2636

Author:(Linder and Dababneh)

As Amended Ver:August 16, 2016

Majority vote

Original Committee Reference: HEALTH

SUMMARY: Allows an official, if an electronic request for a certified copy of a birth, death, or marriage record is made, to accept an electronic verification of identity of the applicant using a remote identity proofing process, as specified, or a notarized statement of identity, to ensure the applicant is authorized under law to receive that record. Specifies that the multilayered remote identity proofing process for the electronic verification authentication must: 1) meet or exceed the National Institute of Standards and Technology electronic authentication guideline for multilayered remote identity proofing; 2) meet the verification requirements, as specified; 3) meet or exceed the information security requirements of the Uniform Electronic Transactions Act, as specified; and, 4) retain for each electronic verification, a record of the applicant whose identity has been verified and the steps taken to verify the identity. Requires, by January 1, 2019, the State Registrar and any city and county that fulfills electronic requests for these vital records without being provided a notarized statement that the requester is an authorized person to report to the Attorney General and the Legislature specified nonpersonally identifiable information.

The Senate amendments add a January 1, 2021 sunset date, authorize the Department of Public Health (DPH) to implement and administer the provisions of this bill through an all-county letter or similar instructions, as specified, and make other technical and conforming changes.

FISCAL EFFECT: According to the Senate Appropriations Committee:

1. DPH: Potential staffing costs of about $275,000 (General Fund (GF)or Special Fund*) through 2020 to support two positions should the DPH opt to establish a secure online verification process. The estimated costs would support two positions to manage a vendor contract for payment processing and reconciling, as well as modifications to the current customer request tracking system. The cost to contract with a private vendor to provide the electronic authentication system and the public interface for accepting electronic applications is undetermined at this time.
2. County registrar/recorder: Potentially significant one-time and ongoing non-reimbursable local costs (local funds) for local agencies to establish and operate a secure online verification process.
3. Vital records fee revenue: Potential shift of fee revenues collected by the state and local agencies should the DPH opt to establish an electronic verification system. Data through fiscal year 2013-14 indicates that counties have historically processed more than 90% of certified copy requests for vital records each year. The adoption of an online verification system by the DPH could increase state fee revenues, and reduce the volume and demand for services in the counties, resulting in reduced local fee revenues and unknown impacts on local operations.
4. Attorney General: Potential minor one-time costs (GF) to accept the information reported by local agencies on the electronic verification process.

*Health Statistics Special Fund

COMMENTS: According to the author, individuals seeking vital records in California suffer longer wait times and pay significantly higher fees than individuals seeking records in most other states due to outdated statutes that govern vital records request policies. The author states that county and local staff are significantly burdened by current policies that dictate that a vital records request may only be partially competed online, followed by a notarized affidavit submitted on paper. This hybrid system of online requesting means, practically, that a vital records request cannot be processed without countless of hours of county staff time wasted because staff must manually attach related documents for each individual request as supporting documentation is submitted. The author further asserts that California's policies are drastically out of step with national trends to increase access to vital government services through online technologies, as 34 other states and 171 local jurisdictions allow for digital authentication of vital records requests online as a standard matter of practice.

Electronic authentication (e-authentication) is the process of establishing confidence in user identities electronically presented to an information system. E-authentication presents a technical challenge when this process involves the remote authentication of individual people over an open network (i.e. the Internet), for the purpose of electronic government and commerce. The National Institute of Standards and Technology, under the United States Department of Commerce, released guidelines in 2013 to provide technical guidance to agencies to allow an individual to remotely authenticate his or her identity to a federal information technology system. These guidelines address only traditional, widely implemented methods for remote authentication based on secrets. With these methods, the individual whose identity is authenticated proves that he or she knows or possesses some secret information.

Analysis Prepared by: Rosielyn Pulmano / HEALTH / (916) 319-2097 FN: 0004334

 THIRD READING  

Bill No: AB 2636

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 7-0, 6/28/16

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/11/16

AYES: Lara, Bates, Beall, Hill, McGuire, Mendoza, Nielsen

ASSEMBLY FLOOR: 80-0, 5/31/16 - See last page for vote

SUBJECT:

SOURCE: California State Association of Counties

Urban Counties of California

DIGEST: This bill authorizes, until January 1, 2021, if a request for a certified copy of a birth, death, or marriage record is made electronically, a state or local official to accept electronic acknowledgement verifying the identity of the applicant using a multilayered remote identity proofing process, as specified. This bill requires state and local agencies fulfilling electronic requests for certified copies of records to report specified information to the Attorney General and the Legislature by January 1, 2019.

ANALYSIS:

Existing law:

1. Allows the State Registrar, local registrar, or county recorder to furnish a certified copy of birth, death, or marriage to applicants upon request if:

• The request is written, faxed, or a digitized image and accompanied by a notarized statement that is written, faxed, or a digitized image, sworn under penalty of perjury, that the requester is an authorized person, as defined; or
• The request is made in person, and the official takes a statement, sworn under penalty of perjury, that the requester is signing his or her own legal name and is an “authorized person.” (Health & Saf. Code Sec. 103526.)

1. Defines “authorized person,” for purposes of obtaining certified copies of birth, death, or marriage records, as any of the following:

• The person who is the subject of the record or the parent or legal guardian of that person;
• A party who is entitled to receive the record as a result of a court order;
• Law enforcement or governmental agency personnel conducting official business;
• A child, grandchild, sibling, spouse, domestic partner, or grandparent of the person who is the subject of the record;
• An attorney or other person empowered to act on behalf of the person who is the subject of the record; or
• An agent or employee of a funeral establishment who orders death certificates when acting on behalf of specified individuals. (Health & Saf. Code Sec. 103526 (c).)

1. Provides that, in all other cases in which the requester does not meet the requirements of an authorized person, a certified copy may be provided to the requester, but the document shall be an informational certified copy and shall be redacted to remove any signatures that appear on the document. Existing law requires the certified copy to contain the statement “INFORMATIONAL, NOT A VALID DOCUMENT TO ESTABLISH IDENTITY.” (Health & Saf. Code Sec. 103526 (b).)

This bill:

1. Authorizes, until 2021, the State Registrar, or a local registrar or county recorder to accept electronic acknowledgement, if the applicant’s identity is verified using a multilayered remote identity proofing process that complies with the following requirements:

• Meets or exceeds the National Institute of Standards and Technology (NIST) electronic authentication guideline for multilayered remote identity proofing;
• Verifies a valid government-issued identification number, and a financial or utility account number; and
• Retains for each electronic verification, as required by the NIST electronic authentication guideline, a record of the applicant whose identity has been verified and the steps taken to verify the identity.

1. Requires that the verification must occur through record checks with the state or local agency or a credit reporting agency or similar database and shall confirm that the name, date of birth, address, or other personal information in the record checks are consistent with the information provided by the applicant.
2. Requires, on or before January 1, 2019, a city, county, or the Department of Public Health that fulfills electronic requests for certified copies of birth, death, or marriage records without being provided a notarized statement that the requester is an authorized person to report the following information to the Attorney General, the Assembly and Senate Judiciary Committees, and the Assembly Committee on Privacy and Consumer Protection:

• The total number of written, electronic, faxed, or in-person requests that include a notarized statement that the requester is an authorized person.
• The total number of electronic requests utilizing the multilayered remote identity proofing process.
• The total number of electronic requests denied while using the multilayered remote identity proofing process due to insufficient information or failed authentication.
• The total number of repeat electronic requests using the multilayered remote identity proofing process for the same record and the same individual.
• A description of the mechanism and process, if any, by which consumers who have been victims of identity theft may temporarily limit electronic access to certified vital records, including all of the following:
  • The number of consumers who have utilized this mechanism and process.
  • The total number of electronic requests that utilize the multilayered remote identity proofing process, without a notarized statement, requesting records of consumers who have used the temporary limited access mechanism and process.
  • The total number of electronic requests for records of consumers who have utilized this temporary limited access mechanism and process that were denied while using the multilayered remote identity proofing process.
• A description of the mechanism and process by which a consumer may report identity theft resulting from an alleged fraudulent records request, as well as the number of consumers who have used this mechanism and process.

Background

The Office of Vital Records is charged with the responsibility of maintaining a uniform system for registration and a permanent central registry with a comprehensive and continuous index for all birth, death, fetal death, marriage, and dissolution certificates registered for vital events which occur in California. Certified copies of these records are available from the State Registrar, the 58 county recorders, and 61 local health jurisdictions.

In November 2001, it was reported that the state had sold the birth records of more than 24 million Californians which were then posted on the Internet. The Senate Insurance Committee held an informational hearing in response, “Personal Privacy at Risk,” which demonstrated the ease with which identity thieves could obtain personal information about others. The informational hearing also revealed that the State Registrar routinely sold electronic compilations of public record information to anyone who could pay for the records with no restrictions on their use. The records sold covered births from 1905 to 1995, and included the county of birth, the person’s full name, date of birth, and the person’s mother’s maiden name. A mother’s maiden name and date of birth are common personal identifiers used by financial institutions to determine if a person may have access to an individual account.

In order to prevent fraud and identity theft, the Legislature has since enacted a number of protective measures with regard to vital records, including AB 247 (Speier, Chapter 914, Statutes of 2002) and AB 1614 (Speier, Chapter 712, Statutes of 2002) which established controls for the release of, and access to, birth and death records. AB 130 (Jeffries, Chapter 412, Statutes of 2009) extended the existing limitations on release and access of birth and death records to marriage records in order to prevent the unauthorized use of personal information. Recently, AB 464 (Daly, Chapter 78, Statutes of 2013) updated the law regarding vital records to allow digitized images to be used, in addition to written or faxed documents, as part of a request for a certified copy of a vital record. Existing law requires that these requests be accompanied by a notarized statement, sworn under penalty of perjury, that the requester is an authorized person. Instead of requiring a notarized statement, which may also be scanned and mailed electronically, this bill, which is substantially similar to AB 2275 (Ridley-Thomas, 2014), allows a registrar or county recorder to accept electronic acknowledgment that the requester of a record is an authorized person.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local: Yes

According to the Senate Appropriations Committee:

• Department of Public Health (DPH): Potential staffing costs of about $275,000 (General Fund or Special Fund*) through 2020 to support two positions should the DPH opt to establish a secure online verification process. The estimated costs would support two positions to manage a vendor contract for payment processing and reconciling, as well as modifications to the current customer request tracking system. The cost to contract with a private vendor to provide the electronic authentication system and the public interface for accepting electronic applications is undetermined at this time.
• County registrar/recorder: Potentially significant one-time and ongoing non-reimbursable local costs (Local Funds) for local agencies to establish and operate a secure online verification process.
• Vital records fee revenue: Potential shift of fee revenues collected by the state and local agencies should the DPH opt to establish an electronic verification system. Data through FY 2013-14 indicates that counties have historically processed more than 90 percent of certified copy requests for vital records each year. The adoption of an online verification system by the DPH could increase state fee revenues, and reduce the volume and demand for services in the counties, resulting in reduced local fee revenues and unknown impacts on local operations.
• Attorney General: Potential minor one-time costs (General Fund) to accept the information reported by local agencies on the electronic verification process.

*Health Statistics Special Fund

SUPPORT: (Verified 8/15/16)

California State Association of Counties (co-source)

Urban Counties of California (co-source)

California Association of Clerks and Election Officials

California Association of County Veteran Service Officers

Computing Technology Industry Association

County Health Executives Association of California

Little Hoover Commission

Los Angeles County Board of Supervisors

Riverside County Board of Supervisors

Rural County Representatives of California

San Bernardino County

Tarrant County Clerk’s Office

TechNet

OPPOSITION: (Verified 8/15/16)

American Civil Liberties Union of California

Privacy Rights Clearinghouse

ARGUMENTS IN SUPPORT: The California State Association of Counties, sponsor, writes:

California and Minnesota are the only two states in the nation which currently require a notarized statement in conjunction with the online request. The option of being able to fully submit an electronic request will significantly reduce processing time for customers. This process will also reduce the overall cost for obtaining copies of vital records. For example, the current fee for a certified copy of a birth certificate in Los Angeles County ranges from $23 to $28. The average notary fee for an affidavit is as much as $20. The total fee for someone requesting this record under the current system of a partial online request could be as much as $50. Contra Costa County processed 5,628 electronic orders last year – the staff time involved in document matching would have saved the county 1,426 staff hours or approximately 35 weeks of work.

ARGUMENTS IN OPPOSITION: In opposition to this bill, the Privacy Rights Clearinghouse (PRC) argues that notarized statements of identity were created as a security precaution to protect against fraud and identity theft and continue to be necessary. PRC writes:

The substitution of an electronic acknowledgement for a notarized affidavit will facilitate the ability of identity thieves and other fraudsters to obtain vital records that can then be used to engage in criminal acts against Californians. Certified copies of birth certificates can be used to fraudulently obtain many other important documents such as passports, driver’s licenses, and identification cards. Certified copies of death certificates can be used to fraudulently obtain decedents’ death benefits, including life insurance proceeds and investment accounts.

Vital records contain a wealth of personal information, which if inappropriately released to the wrong person can result in a significant violation of privacy. Privacy is protected by California's Constitution, and should not be set aside merely to facilitate the issuance of vital records.

ASSEMBLY FLOOR: 80-0, 5/31/16

AYES: Achadjian, Alejo, Travis Allen, Arambula, Atkins, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Rendon

Prepared by: Nichole Rapier / JUD. / (916) 651-4113

8/16/16 17:33:37

**** END ****

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2015 - 2016 Regular Session

AB 2636 (Linder) - Certified copies of marriage, birth, and death certificates: electronic application

*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********

The following information is revised to reflect amendments

adopted by the committee on August 11, 2016

Bill Summary:

AB 2636 would authorize, until January 1, 2021, if a request for a certified copy of a birth, death, or marriage record is made electronically, a state or local official to accept electronic acknowledgement verifying the identity of the applicant using a multilayered remote identity proofing process, as specified. This bill would require state and local agencies fulfilling electronic requests for certified copies of records to report specified information to the Attorney General and the Legislature by January 1, 2019.

Fiscal Impact:

• Department of Public Health (DPH): Potential staffing costs of about $275,000 (General Fund or Special Fund*) through 2020 to support two positions should the DPH opt to establish a secure online verification process. The estimated costs would support two positions to manage a vendor contract for payment processing and reconciling, as well as modifications to the current customer request tracking system. The cost to contract with a private vendor to provide the electronic authentication system and the public interface for accepting electronic applications is undetermined at this time.
• County registrar/recorder: Potentially significant one-time and ongoing non-reimbursable local costs (Local Funds) for local agencies to establish and operate a secure online verification process.
• Vital records fee revenue: Potential shift of fee revenues collected by the state and local agencies should the DPH opt to establish an electronic verification system. Data through FY 2013-14 indicates that counties have historically processed more than 90 percent of certified copy requests for vital records each year. The adoption of an online verification system by the DPH could increase state fee revenues, and reduce the volume and demand for services in the counties, resulting in reduced local fee revenues and unknown impacts on local operations.
• Attorney General: Potential minor one-time costs (General Fund) to accept the information reported by local agencies on the electronic verification process.

*Health Statistics Special Fund

Author Amendments:

• Authorize the DPH to implement and administer the changes made by the bill through an all-county letter or similar instructions from the State Registrar without taking regulatory action.
• Provide that an electronic verification of identity accompanied by an electronic statement sworn under penalty of perjury may be accepted.
• Make other technical and conforming changes.

Committee Amendments:

Provide that if the DPH elects to fulfill electronic requests for certified copies of records, to report specified information to the Attorney General and the Legislature by January 1, 2019.

-- END --

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2015 - 2016 Regular Session

AB 2636 (Linder) - Certified copies of marriage, birth, and death certificates: electronic application

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 2636 would authorize, until January 1, 2021, if a request for a certified copy of a birth, death, or marriage record is made electronically, a state or local official to accept electronic acknowledgement verifying the identity of the applicant using a multilayered remote identity proofing process, as specified. This bill would require local agencies fulfilling electronic requests for certified copies of records to report specified information to the Attorney General and the Legislature by January 1, 2019.

Fiscal Impact:

• Department of Public Health (DPH): Potential staffing costs of about $275,000 (General Fund or Special Fund*) through 2020 to support two positions should the DPH opt to establish a secure online verification process. The estimated costs would support two positions to manage a vendor contract for payment processing and reconciling, as well as modifications to the current customer request tracking system. The cost to contract with a private vendor to provide the electronic authentication system and the public interface for accepting electronic applications is undetermined at this time.
• County registrar/recorder: Potentially significant one-time and ongoing non-reimbursable local costs (Local Funds) for local agencies to establish and operate a secure online verification process.
• Vital records fee revenue: Potential shift of fee revenues collected by the state and local agencies should the DPH opt to establish an electronic verification system. Data through FY 2013-14 indicates that counties have historically processed more than 90 percent of certified copy requests for vital records each year. The adoption of an online verification system by the DPH could increase state fee revenues, and reduce the volume and demand for services in the counties, resulting in reduced local fee revenues and unknown impacts on local operations.
• Attorney General: Potential minor one-time costs (General Fund) to accept the information reported by local agencies on the electronic verification process.

*Health Statistics Special Fund

Background:

Under existing law, a certified copy of a birth, death, marriage, or military service record may only be supplied by the State Registrar, local registrar, or county recorder to an authorized person who submits a written, faxed, or digitized image request accompanied by a notarized statement sworn under penalty of perjury that the applicant is an authorized person, as specified. (Health and Safety Code § 103526.)

The Little Hoover Commission, in its 2015 report, A Customer-Centric Upgrade for California Government, identified opportunities for improved customer experience across state government, including its vital records program. The report noted that

Proposed Law:

This bill would authorize, until January 1, 2021, the State Registrar, local registrar, or county recorder to accept requests for certified copies of birth, death, or marriage records made electronically through electronic acknowledgement verifying the identity of the applicant using a multilayered remote identity proofing process that complies with all of the following requirements:

• Meets or exceeds the National Institute of Standards and Technology (NIST) electronic authentication guideline for multilayered remote identity proofing.
• Verifies specified information provided by the applicant.
• Meets or exceeds the information security requirements of the Uniform Electronic Transactions Act, the Federal Information Security Management Act of 2002 (Public Law 107-347), and all other applicable state and federal laws and regulations to protect the personal information of the applicant and guard against identity theft.
• Retains for each electronic verification, as required by the NIST electronic authentication guideline, a record of the applicant whose identity has been verified and the steps taken to verify the identity.

If an applicant’s identity cannot be established electronically as specified above, this bill requires the applicant to include with his or her request a statement of identity that has been notarized.

This bill requires on or before January 1, 2019, a city or county that fulfills electronic requests for certified copies of birth, death, or marriage records without being provided a notarized statement that the requester is an authorized person to report the following information to the Attorney General, the Assembly and Senate Judiciary Committees, and the Assembly Committee on Privacy and Consumer Protection:

• All of the following non-personally identifiable information:
  • The total number of written, electronic, faxed, or in-person requests that include a notarized statement that the requester is an authorized person.
  • The total number of electronic requests utilizing the multilayered remote identity proofing process.
  • The total number of electronic requests denied while using the multilayered remote identity proofing process due to insufficient information or failed authentication.
  • The total number of repeat electronic requests using the multilayered remote identity proofing process for the same record and the same individual.
• A description of the mechanism and process, if any, by which consumers who have been victims of identity theft may temporarily limit electronic access to certified vital records, including all of the following:
  • The number of consumers who have utilized this mechanism and process.
  • The total number of electronic requests that utilize the multilayered remote identity proofing process, without a notarized statement, requesting records of consumers who have used the temporary limited access mechanism and process.
  • The total number of electronic requests for records of consumers who have utilized this temporary limited access mechanism and process that were denied while using the multilayered remote identity proofing process.
• A description of the mechanism and process by which a consumer may report identity theft resulting from an alleged fraudulent records request, as well as the number of consumers who have used this mechanism and process.

Related Legislation:

AB 2275 (Ridley-Thomas) 2014 was similar in purpose to this bill but did not include the level of data security authentication required in this measure. AB 2275 failed passage in the Senate Committee on Judiciary.

Recommended Amendments:

To the extent the DPH opts to fulfill electronic requests for certified copies of birth, death, or marriage records without being provided a notarized statement that the requester is an authorized person, the author may wish to consider an amendment to additionally require the DPH to report to the AG with information on the newly adopted system.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015-2016 Regular Session

Bill No: AB 2636 (Author:Linder)

Version: April 12, 2016

Hearing Date: June 28, 2016

Fiscal: Yes

Urgency: No

Consultant: NR

SUBJECT

Certified copies of marriage, birth, and death certificates: electronic application

DESCRIPTION

This bill would, if the request for a certified copy of a birth, death, or marriage record is made electronically, authorize the official to accept electronic acknowledgment verifying the identity of the applicant using a multilayered remote identity proofing process, as specified.

BACKGROUND

The Office of Vital Records is charged with the responsibility of maintaining a uniform system for registration and a permanent central registry with a comprehensive and continuous index for all birth, death, fetal death, marriage, and dissolution certificates registered for vital events which occur in California. Certified copies of these records are available from the State Registrar, the 58 county recorders, and 61 local health jurisdictions.

In November 2001, it was reported that the state had sold the birth records of more than 24 million Californians which were then posted on the Internet. The Senate Insurance Committee held an informational hearing in response, “Personal Privacy at Risk,” which demonstrated the ease with which identity thieves could obtain personal information about others. The informational hearing also revealed that the State Registrar routinely sold electronic compilations of public record information to anyone who could pay for the records with no restrictions on their use. The records sold covered births from 1905 to 1995, and included the county of birth, the person’s full name, date of birth, and the person’s mother’s maiden name. A mother’s maiden name and date of birth are common personal identifiers used by financial institutions to determine if a person may have access to an individual account.

In order to prevent fraud and identity theft, the Legislature has since enacted a number of protective measures with regard to vital records, including AB 247 (Speier, Ch. 914, Stats. 2002) and AB 1614 (Speier, Ch. 712, Stats. 2002) which established controls for the release of, and access to, birth and death records. AB 130 (Jeffries, Ch. 412, Stats. 2009) extended the existing limitations on release and access of birth and death records to marriage records in order to prevent the unauthorized use of personal information. Recently, AB 464 (Daly, Ch. 78, Stats. 2013) updated the law regarding vital records to allow digitized images to be used, in addition to written or faxed documents, as part of a request for a certified copy of a vital record. Existing law requires that these requests be accompanied by a notarized statement, sworn under penalty of perjury, that the requester is an authorized person. Instead of requiring a notarized statement, which may also be scanned and mailed electronically, this bill, which is substantially similar to AB 2275 (Ridley-Thomas, 2014), would allow a registrar or county recorder to accept electronic acknowledgment that the requester of a record is an authorized person.

CHANGES TO EXISTING LAW

Existing law allows the State Registrar, local registrar, or county recorder to furnish a certified copy of birth, death, or marriage to applicants upon request if:

• the request is written, faxed, or a digitized image and accompanied by a notarized statement that is written, faxed, or a digitized image, sworn under penalty of perjury, that the requester is an authorized person, as defined; or
• the request is made in person, and the official takes a statement, sworn under penalty of perjury, that the requester is signing his or her own legal name and is an “authorized person.” (Health & Saf. Code Sec. 103526.)

Existing law defines “authorized person,” for purposes of obtaining certified copies of birth, death, or marriage records, as any of the following:

• the person who is the subject of the record or the parent or legal guardian of that person;
• a party who is entitled to receive the record as a result of a court order;
• law enforcement or governmental agency personnel conducting official business;
• a child, grandchild, sibling, spouse, domestic partner, or grandparent of the person who is the subject of the record;
• an attorney or other person empowered to act on behalf of the person who is the subject of the record; or
• an agent or employee of a funeral establishment who orders death certificates when acting on behalf of specified individuals. (Health & Saf. Code Sec. 103526 (c).)

Existing law provides that, in all other cases in which the requester does not meet the requirements of an authorized person, a certified copy may be provided to the requester, but the document shall be an informational certified copy and shall be redacted to remove any signatures that appear on the document. Existing law requires the certified copy to contain the statement “INFORMATIONAL, NOT A VALID DOCUMENT TO ESTABLISH IDENTITY.” (Health & Saf. Code Sec. 103526 (b).)

This bill would authorize the State Registrar, or a local registrar or county recorder to accept electronic acknowledgement, if the applicant’s identity is verified using a multilayered remote identity proofing process that complies with the following requirements:

• meets or exceeds the National Institute of Standards and Technology (NIST) electronic authentication guideline for multilayered remote identity proofing; and
• verifies a valid government-issued identification number, and a financial or utility account number.

This bill would require that the verification must occur through record checks with the state or local agency or a credit reporting agency or similar database and shall confirm that the name, date of birth, address, or other personal information in the record checks are consistent with the information provided by the applicant.

COMMENT

1. Stated need for the bill

According to the author:

Unfortunately, individuals seeking vital records in California suffer longer wait times and pay significantly higher fees than individuals seeking records in almost every other state due to outdated statutes that govern vital records requesting policies in California. […]Vital records (typically birth, death, marriage and divorce records) are critical documents which are required for many of life's most significant events.  This is particularly true for birth and death records. For example, birth certificates are necessary for school enrollment, participation in youth sports, obtaining a driver's license, obtaining a passport, and applying for Social Security or Medicaid benefits.  Death certificates are documents often needed by loved ones in order to obtain life insurance benefits, and close out financial accounts and investments, etc. Each of these documents is frequently needed expeditiously and more often than not, the individual needing them does not live in the city, county, or even state where the birth or death occurred. […]

AB 2636 brings California into conformity with all other states in the country, except for Minnesota, that do not require a separate notarized statement of identity when making a remote request for vital records. The bill follows the findings of the Little Hoover Commission’s 2015 Report seeking a more customer-centric delivery of California government services by allowing for secure online processing of vital records requests benefitting both county staff and California citizens at large.

The California State Association of Counties, sponsor, writes:

California and Minnesota are the only two states in the nation which currently require a notarized statement in conjunction with the online request. The option of being able to fully submit an electronic request will significantly reduce processing time for customers. This process will also reduce the overall cost for obtaining copies of vital records. For example, the current fee for a certified copy of a birth certificate in Los Angeles County ranges from $23 to $28. The average notary fee for an affidavit is as much as $20. The total fee for someone requesting this record under the current system of a partial online request could be as much as $50. Contra Costa County processed 5,628 electronic orders last year – the staff time involved in document matching would have saved the county 1,426 staff hours or approximately 35 weeks of work.

1. Potential for identity theft

This bill would eliminate the requirement that a person submit a notarized statement of identification when he or she electronically requests vital records. The author argues that this is necessary because “in 2012, Los Angeles County’s Registrar received more than 64,000 online requests for vital records. This accounted for 22% of all requests for vital records that year. The average wait time for a customer who submits a vital records request under the current system, that is partially an electronic submission, is 6 to 8 weeks. […]This is not to mention the additional price of the notary fee on consumers which adds an additional average of $10 to $15 to the existing cost of a copy of a vital record. In Los Angeles, the cost of a vital record is $28, meaning that consumers are paying over a third of the cost for a fee that no other state charges except for Minnesota and is not necessary as identities can be confirmed online as evidenced by California’s voter registration system.”

The requirement that a person requesting a certified copy of a vital record must include a notarized statement of identity was created as a security precaution to protect against fraud and identity theft. In opposition to this bill, the Privacy Rights Clearinghouse (PRC) argues that such protections continue to be necessary. PRC writes:

The substitution of an electronic acknowledgement for a notarized affidavit will facilitate the ability of identity thieves and other fraudsters to obtain vital records that can then be used to engage in criminal acts against Californians. Certified copies of birth certificates can be used to fraudulently obtain many other important documents such as passports, driver’s licenses, and identification cards. Certified copies of death certificates can be used to fraudulently obtain decedents’ death benefits, including life insurance proceeds and investment accounts.

Vital records contain a wealth of personal information, which if inappropriately released to the wrong person can result in a significant violation of privacy. Privacy is protected by California's Constitution, and should not be set aside merely to facilitate the issuance of vital records.

Arguably, an electronic identity verification process offers little assurance that identity thieves will not receive documents that can, by their nature, be used to establish identity. The sponsor and the author argue that the high cost associated with obtaining a vital record justifies a more affordable, elctronic process, but the costs associated with identity theft are arguably much higher. It should be noted that individuals can always request vital records without the use of a notary, but those documents are for informational purposes only and not to establish identity. If a person wishes to use the document for identification purposes, the request must be notarized or the individual must submit the request in person. This bill seeks to instead allow individuals to request vital records that can be used for identification purposes without the use of a notary. Given the inherent difficulties in verifying the identity of an individual over the Internet, and the countless opportunities for identity theft that vital records in the wrong hands create, strong protections must be in place to ensure that vital records are safely maintained.

1. Security measures

AB 2275 (Ridley-Thomas, 2014), which was substantially similar to this bill, failed passage in the Senate Judiciary Committee in 2014. The Committee analysis noted that the bill lacked adequate security measures and that the increased risk of identity theft outweighed the benefits of the bill.

AB 2275 required that an electronic request for a vital record to provide a method for the official to establish the identity of the requester electronically. The method established to process electronic requests and establish the requester’s identitywas required to comply with the provisions of the California Uniform Electronic Transactions Act (Act). (Civ. Code Secs. 1633.1-1633.17.) The purpose of the Act is to standardize state laws regarding retention of paper records (namely checks) and electronic signatures, in an effort to facilitate the validity of electronic contracts and transactions.

The Committee analysis noted that the Act does little in the way of providing security against fraud. It allows for electronic notarization of signatures and provides that the requirement of an electronic signature under penalty of perjury is satisfied if the “electronic record includes, in addition to the electronic signature, all of the information as to which the declaration pertains together with a declaration under penalty of perjury by the person who submits the electronic signature that the information is true and correct.” (Civ. Code Sec. 1633.11(a) - (b).) Further, the Act does not require any standard of security, but merely defines a security procedure as “a procedure employed for the purpose of verifying that an electronic signature, record, or performance is that of a specific person or for detecting changes or errors in the information in an electronic record. The term includes a procedure that requires the use of algorithms or other codes, identifying words or numbers, encryption, or callback or other acknowledgment procedures.” (Civ. Code Sec. 1633.2(n).)

Accordingly, this bill includes additional security provisions than those included in AB 2275. In addition to compliance with the Act, this bill requires a “multilayered remote identity proofing process” that “meets or exceeds the National Institute of Standards and Technology (NIST) electronic authentication guideline.” This includes that a valid government-issued identification number and a financial or utility account number are verified.

The American Civil Liberties Union, in opposition, argues that privacy protections should not be set aside merely to facilitate the issuance of vital records:

If this legislation is to be enacted it should include a two-year sunset in order to assess the impacts of loosening the requirements for obtaining vital records online. Additionally, the bill should include a reporting mechanism for people who have been victims of identity theft and prohibit fulfilling vital records requests of persons who have placed fraud alerts or credit reports on their account when the request is submitted using multilayered remote identity proofing. If a public entity wishes to release records without a notarized affidavit of identity, the entity furnishing the records must be liable for any identity theft that occurs after a person uses this process to request a vital record.

In light of the above concerns and the Committee’s reluctance to pass similar legislation in the past, if this Committee were to approve this bill it should consider doing so only if the bill include a two year sunset so that the Legislature may review the impacts of allowing individuals to request vital records online. The author may wish to additionally consider including a mechanism for acknowledging fraud alerts that have been placed by persons who have experienced identity theft.

Suggested amendment:

Sunset the provisions of the bill on January 1, 2019.

Support: California Association of Clerks and Election Officials; California Association of County Veteran Service Officers; Computing Technology Industry Association (CompTIA); County Health Executives Association of California (CHEAC)

Little Hoover Commission; Los Angeles County Board of Supervisors; Riverside County Board of Supervisors; Rural County Representatives of California (RCRC); San Bernardino County; Tarrant County Clerk’s Office; TechNet;

Opposition: ACLU of California; Privacy Rights Clearinghouse

HISTORY

Source: California State Association of Counties; Urban Counties of California

Related Pending Legislation: None Known

Prior Legislation:

AB 2275 (Ridley-Thomas) See Comment 3.

AB 464 (Daly, Chapter 78, Statutes of 2013) allowed digitized images, as defined, to be included as part of a request for a certified copy of a birth, death, or marriage record.

AB 130 (Jeffries, Chapter 412, Statutes of 2009) extended the existing limitations on the release and access of birth and death records to marriage records in order to prevent the unauthorized use of personal information.

SB 1398 (Margett and Hollingsworth, 2008) was substantially similar to SB 471. This bill died in the Senate Health Committee.

SB 471 (Margett, 2007) would have required any individual, authorized by law to obtain a certified copy of a birth or death certificate, to show proof of identification when the request is made in person, except when the individual has been a victim of identity theft. This bill died in the Senate Health Committee.

SB 904 (Battin, 2007) would have required the county recorder, when furnishing an informational copy of a military service record, to alter that record by masking the service member’s personal information, as specified, without incurring any liability. This bill was vetoed by Governor Schwarzenegger.

AB 1179 (Parra, Chapter 6, Statutes of 2004) prohibited county recorders from providing certified copies of military discharge papers except to specified persons and allowed county recorders to accept faxed, notarized documents when specified information is present and photographically reproducible.

AB 247 (Speier, Chapter 914, Statutes of 2002) authorized the State Registrar, local registrar or county recorder to provide a certified copy of a birth or death record to an authorized person who submits a statement sworn under penalty of perjury that the requester is signing his or her own legal name and is an authorized person.

Prior Vote:

Assembly Floor (Ayes 80, Noes 0)

Assembly Appropriations Committee (Ayes 20, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

Assembly Health Committee (Ayes 19, Noes 0)

**************

ASSEMBLY THIRD READING

ATR Bill Id:AB 2636

Author:(Linder and Dababneh)

As Amended Ver:April 12, 2016

Majority vote

SUMMARY: Allows an official, if an electronic request for a certified copy of a birth, death, or marriage record is made, to accept an electronic acknowledgment verifying the identity of the applicant using a remote identity proofing process, as specified, or a notarized statement of identity, to ensure the applicant is authorized under law to receive that record.

FISCAL EFFECT: According to the Assembly Appropriations Committee:

1. This bill is permissive, thus it does not have direct costs to the California Department of Public Health (DPH). However, allowing the use of an electronic option results in significant cost pressure to DPH to establish secure electronic verification methodology for vital records.

If DPH established online verification, it is anticipated that two staff would be needed to manage a vendor contract and support the information technology needs for a cost of $270,000 annually (Health Statistics Special Fund). Costs for authentication would be paid by the consumer. It is worth noting the cost to the consumer for digital authentication would likely be significantly less than the cost of having to provide a sworn statement from a notary.

1. Vital records fee revenue could potentially shift between the state and counties, depending on whether and how the authority in this bill is used.

COMMENTS: According to the author, individuals seeking vital records in California suffer longer wait times and pay significantly higher fees than individuals seeking records in most other states due to outdated statutes that govern vital records request policies. The author states that county and local staff are significantly burdened by current policies that dictate that a vital records request may only be partially competed online, followed by a notarized affidavit submitted on paper. This hybrid system of online requesting means, practically, that a vital records request cannot be processed without countless of hours of county staff time wasted because staff must manually attach related documents for each individual request as supporting documentation is submitted. The author further asserts that California's policies are drastically out of step with national trends to increase access to vital government services through online technologies, as 34 other states and 171 local jurisdictions allow for digital authentication of vital records requests online as a standard matter of practice.

Electronic authentication (e-authentication) is the process of establishing confidence in user identities electronically presented to an information system. E-authentication presents a technical challenge when this process involves the remote authentication of individual people over an open network (i.e. the internet), for the purpose of electronic government and commerce. The National Institute of Standards and Technology, under the United States Department of Commerce, released guidelines in 2013 to provide technical guidance to agencies to allow an individual to remotely authenticate his or her identity to a federal information technology system. These guidelines address only traditional, widely implemented methods for remote authentication based on secrets. With these methods, the individual whose identity is authenticated proves that he or she knows or possesses some secret information.

The Urban Counties Caucus, cosponsor of this bill, writes in support that counties process thousands of these types of requests which can be very time consuming for both county staff and consumers. This bill would provide a more user-friendly way to get access to these records through established systems that verify the user’s identity which could provide significant cost savings to counties and provide better customer service. The California State Association of Counties, cosponsor of the bill, states that updating vital records requests could also reduce the overall cost for consumers when obtaining vital records. The current fee for a certified copy of a birth certificate in Los Angeles County ranges from $23 to $28, and the average notary fee is an additional $20.

Privacy Rights Clearinghouse (PRC) opposes on the grounds that substitution of an electronic acknowledgement for a notarized affidavit will facilitate the ability of identity thieves and other fraudsters to obtain vital records that can then be used to engage in criminal acts against Californians. Vital records contain a wealth of personal information, which if inappropriately released to the wrong person can result in significant privacy violations. PRC further states that any legislation expanding the ability to obtain vital records online must have sufficient protections in place to protect Californians' sensitive personal information and prevent identity theft and other fraudulent activity.

Analysis Prepared by: John Gilman / HEALTH / (916) 319-2097 FN: 0003292

Date of Hearing: May 4, 2016

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez, Chair

ABPCA Bill Id:AB 2636

Author:(Linder) – As Amended Ver:April 12, 2016

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill allows, if a request is made electronically for a certified copy of a birth, death, or marriage record, an official to accept an electronic acknowledgment verifying the identity of the requestor using a remote identity proofing process to ensure the requester is an authorized person. It also specifies security standards for the identity proofing process.

FISCAL EFFECT:

1. This bill is permissive, thus it does not have direct costs to the California Department of Public Health (CDPH). However, allowing the use of an electronic option results in significant cost pressure to CDPH to establish secure electronic verification methodology for vital records.

If CDPH established online verification, it is anticipated that two staff would be needed to managed a vendor contract and support the information technology needs for a cost of $270,000 annually (Health Statistics Special Fund). Costs for authentication would be paid by the consumer. It is worth noting the cost to the consumer for digital authentication would likely be significantly less than the cost of having to provide a sworn statement from a notary.

1. Vital records fee revenue could potentially shift between the state and counties, depending on whether and how the authority in this bill is used. If the state provides a secure and consumer-friendly way to request vital records, it could lead to a much larger volume of vital records requests coming in to the state, and decrease demand to county systems, particularly in counties that do not develop their own electronic systems. If this occurred, a transfer of fee revenue from the counties to the state could have significant fiscal consequences for county clerks. On the other hand, widespread adoption of electronic systems by counties could have the opposite effect of reducing demand and fee revenue for the state. Although fee revenue covers the costs of doing business for both the state and counties, significant changes to demand and revenue could disrupt operations, particularly for smaller counties.

COMMENTS:

1. Purpose. The state currently does not have authority to verify identity in a completely automated way for purposes of vital records. This bill is intended to provide that authority, allowing electronic authentication in lieu of requiring a notarized affidavit of identity. The author states local agencies have established online systems for individuals to request vital records, but the legal requirement for a notarized affidavit poses a barrier to completing the entire process electronically.
2. Background. Both the state and counties issue certified copies of vital records, including birth, death, and marriage certificates. Current law requires a request for a certified copy to either be made in person, or submitted with a notarized affidavit of identity for mail, fax and online requests. Although the state processes requests by mail, some local agencies such as Los Angeles County have created online systems.
3. Prior Legislation.
4. AB 1238 (Linder) was substantially similar to this bill and was held on the Suspense File of this Committee.
5. AB 2275 (Author:Ridley-Thomas) of 2013 was similar to this bill and failed in the Senate Judiciary Committee.
6. AB 464 (Daly), Chapter 78, Statutes of 2013, allows for requests of birth, death, and marriage certificates using digitized images of a notarized statement.
7. Support. Counties, clerks and election officials, and Little Hoover Commission support this bill, citing potential for improved efficiency, a higher level of service and lower costs.
8. Opposition. Privacy Rights Clearinghouse oppose this bill, citing risk of identity theft and threats to information privacy. American Civil Liberties Union (ACLU) of California is opposed unless amended and it seeks amendments related to identity theft.

Analysis Prepared by: Lisa Murawski / APPR. / (916) 319-2081

Date of Hearing: April 19, 2016

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2636 (

Author:Linder and Dababneh) – As Amended Ver:April 12, 2016

SUBJECT: Certified copies of marriage, birth, and death certificates: electronic application

SUMMARY: Allows a public records official, if an electronic request for a certified copy of a birth, death, or marriage record is made, to accept an electronic acknowledgment verifying the identity of the requester using a remote identity proofing process to ensure the requester is an authorized person. Specifically, this bill:

1. Authorizes the State Registrar, or a local registrar or county recorder, if a request for a certified copy of a birth, death, or marriage record is made electronically, to accept electronic acknowledgement, sworn under penalty of perjury, that the requester of a marriage, birth, or death certificate is an authorized person.
2. Requires the electronic request for vital records to utilize a method for the official to establish the identity of the requester using a multilayered remote identity proofing process, as specified.
   
3. Requires that the method to process electronic requests and to establish the requester’s identity meet all the following requirements:
   
   1. Meets or exceeds the National Institute of Standards and Technology (NIST) electronic authentication guideline for multilayered remote identity proofing;
      
   2. Verifies the following information provided by the applicant:
      
      1. A valid government-issued identification number; and
         
      2. A financial or utility account number.

The verification must occur through record checks with the state or local agency or a credit reporting agency or similar database and must confirm that the name, date of birth, address, or other personal information in such record checks are consistent with the information provided by the applicant.

• 1. Meets or exceeds the information security requirements of the Uniform Electronic Transactions Act and the Federal Information Security Management Act and all other applicable state and federal laws and regulations to protect the personal information of the applicant and guard against identity theft.
     
  2. Retains, for each electronic verification as required by the NIST electronic authentication guideline, a record of the applicant who identity has been verified and the steps taken to verify the identity.

1. Provides that if a requester's identity cannot be established electronically, then the requester must accompany his or her request with a notarized statement of identity.
2. Makes other non-substantive, clarifying changes to current law.

EXISTING LAW:

1. Charges the Office of Vital Records, within the California Department of Public Health, with the responsibility of maintaining a uniform system for registration and a permanent central registry with a comprehensive and continuous index for all birth, death, fetal death, marriage, and dissolution certificates registered for vital events which occur in California. (Health & Safety Code (HSC) Section 102180 et seq.)
2. Allows the State Registrar, local registrar, or county recorder to furnish a certified copy of birth, death, or marriage to applicants upon request if:
   1. The request is written, faxed, or a digitized image and accompanied by a notarized statement that is written, faxed, or a digitized image, sworn under penalty of perjury, that the requester is an authorized person, as defined; or
   2. The request is made in person, and the official takes a statement, sworn under penalty of perjury, that the requester is signing his or her own legal name and is an “authorized person.” (HSC 103526)
      
3. Defines “authorized person,” for purposes of obtaining certified copies of birth, death, or marriage records, as any of the following:
   1. The person who is the subject of the record or the parent or legal guardian of that person;
      
   2. A party who is entitled to receive the record as a result of a court order;
   3. Law enforcement or governmental agency personnel conducting official business;
   4. A child, grandchild, sibling, spouse, domestic partner, or grandparent of the person who is the subject of the record;
   5. An attorney or other person empowered to act on behalf of the person who is the subject of the record; or
   6. An agent or employee of a funeral establishment who orders death certificates when acting on behalf of specified individuals. (HSC 103526(c))
      
4. Provides that, in all other cases in which the requester does not meet the requirements of an authorized person, a certified copy may be provided to the requester but the document shall be an informational certified copy and shall be redacted to remove any signatures that appear on the document. (HSC 103526(b))
5. Requires the certified copy to contain the statement “INFORMATIONAL, NOT A VALID DOCUMENT TO ESTABLISH IDENTITY.” (HSC 103526(b))

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill. This bill is intended to streamline the process for requesting official copies of birth, death and marriage certificates (vital records) by permitting county recorders and the California Office of Vital Records to accept online applications for the records and requiring an electronic identity authentication process similar to what is used in 41 other states for vital records requests. This measure is sponsored by the California State Association of Counties and the Urban Counties of California.
2. Author’s statement. According to the author's office, “Individuals seeking vital records in California suffer longer wait times and pay significantly higher fees than individuals seeking records in almost every other state due to outdated statutes that govern vital records requesting policies in California. Recognizing the advanced security capabilities of remote verification technologies, vital records agencies—with the exception of those in California and Minnesota—have moved away from reliance solely on notarized statements of identity. Accepted as a standard method of practice by the majority of vital records agencies nationwide, AB 2636 allows local jurisdictions to offer an alternative method of verification for vital records requests using remote identity proofing processes, so long as they adhere to a stringent set of federal cybersecurity guidelines. This much-needed measure will bring California’s antiquated vital record request system into the 21st Century, thereby not only easing the financial burden on local jurisdictions, but also increasing the security of their processing systems.”
3. What are vital records? Vital records are birth certificates, death certificates and marriage certificates, and they are kept on file in the county in which the person was born, married or died. The California Office of Vital Records has a statewide database of vital records. People need certified copies of their birth certificate when they apply for their first driver’s license or passport, and it is not uncommon for birth certificates to be lost in the years between birth and adulthood.

Copies of marriage certificates are needed in cases of divorce and in cases where one spouse is from another country and the marriage is the basis for legal residency in the United States. Here again, when the certificate is lost a new official copy must be obtained. When a person dies, several copies of the official death certificate are typically needed in order to complete legal transactions to transfer assets to the decedents’ heirs.

Vital records are almost never needed for financial transactions, such as opening a bank account or getting a mortgage. However, privacy advocates argue that birth certificates are “breeder” documents, because identity thieves can use them to get other identity documents, such as a driver’s license or passport, in their victim’s name.

1. California’s “tangible interest” law for vital records. California, like 41 other states, has a “tangible interest” law, which requires that only unofficial, non-certified copies of vital records may be released unless the person swears under penalty of perjury that they are a family member or another person with a “tangible interest” in obtaining an official, certified copy of the birth, death or marriage certificate.

In California, some counties have an online application to request a vital record, but all counties must require applicants to follow up with a paper form signed in ink and notarized, in which the applicant swears under penalty of perjury that he or she has a right to a certified copy of the record. This notarized form can be faxed or mailed to the county recorder.

However, the processing time in California for obtaining an official vital record is typically very slow. According to one of the bill’s sponsors, Urban Counties of California, counties process thousands of vital records requests, which can be very time consuming for county staff and costly for county government.

This bill would allow counties to use an electronic process to receive a vital records application. The new process would require identity verification against a government database or a person’s credit record, and would still require applicants to swear under penalty of perjury they have a right to a certified copy of the record.

The electronic process under this bill would be somewhat similar to the process California now uses to allow people to register to vote online. The Secretary of State’s online voter registration website requires applicants to affirm under penalty of perjury that they are a citizen of the United States by clicking a button on the online voter registration application. The SOS then checks the applicant’s driver’s license number against the Department of Motor Vehicles database to verify the person’s identity. If the person’s identity cannot be confirmed then the applicant must mail in a signed paper voter registration application.

1. The NIST standard. NIST is responsible for developing information security standards for federal information systems. NIST’s electronic authentication guidelines provide standards for remote authentication of users interacting with government IT systems over open networks. It also defines the technical requirements for each level of assurance for remote identity proofing. Under this bill, the electronic verification accepted by a California official would have to be in compliance with each update of the NIST guidelines to ensure that the most up to date security standards for electronic authentication.

Under the current NIST guideline, e-authentication credentials may be considered the electronic analog of paper credentials. That is, the remote verification process must meet the same level of confidence in verifying an individual’s identity as an affidavit of identity provided by a notary. In both cases of a paper credential such as an affidavit of identity, or the electronic credential provided by identity proofing technology, a valid credential authoritatively binds an identity to the necessary information for verifying that a person is entitled to claim the identity. For the federal government’s operations, an electronic verification that complies with the NIST is not a less secure verification, but rather a different mode of assuring the identity.

The multilayered knowledge-based identity authentication method NIST requires for remote identity proofing is as follows. The NIST guidelines require that an applicant supply his or her full legal name, an address of record, date or birth and any other information requested by the agency before any additional identity proofing methods are employed. The sensitive data collected during the registration and identity proofing stage must be protected by the agency at all times including in transmission and storage to ensure their security and confidentiality of data. Next the agency must verify the personal data provided by checking the data against a government database or the applicant’s credit report, or perhaps a specialty consumer credit report such as one containing consumer utility service accounts. Once the agency has determined that the identity exists and is not a fabricated identity, the agency then asks the applicant a series of questions, which are designed to test whether the applicant is in fact the person they claimed to be on the application. This is called “knowledge-based authentication” or KBA, and involves multiple-choice questions that ask the user about his or her past residences and credit history. The questions range from “On which of the following streets have you lived?” to “What is your total scheduled monthly mortgage payment?” This bill requires all of these layers of authentication required by NIST in addition to other protections.

The author also notes that the NIST standard is not only used by the agencies that process vital records requests in 41 other but also by thousands of other state, local, and federal government agencies as well as financial institutions and health care organizations, which hold sensitive medical and financial information. For example, CalSTRS currently authenticates identity using KBA to allow access to online retirement account information and the California State Controller’s Office uses KBA to authenticate identity for applications to recover unclaimed property.

Bruce Schneier, Chief Technology Officer of Resilient Systems and a fellow at Harvard’s Berkman Center, has stated that visual verifications of identification documents (such as when a notary public looks at a driver’s license) are no more than “security theatre” as they make the public feel secure, but actually don’t provide a true security benefit. In June 2012, Schneier stated that “the only real solution is to move the security model from the document to the database. With online verification, the document matters much less, because it is nothing more than a pointer into a database.”

1. Modernization in other states. Forty-one other states have already moved away from paper-based vital records requests. Another six states have open records laws that allow anyone to get an official copy of a vital record, so no identity verification is required. Taken together, only California and Minnesota still have a paper-based application process that requires a notarized signature to obtain an official copy of a birth, death or marriage certificate.

For example, in Massachusetts, which like California has a tangible interest law, the online application begins with the applicant entering name, date of birth, address, social security number, and other information. Each applicant must submit a credit card for payment and the name on the credit card must match the name of the applicant. The applicant must then select “I acknowledge” to affirm that they understand that the law restricts access to family members and certain others and that violation of the law is a crime. Next, the agency verifies the applicant’s information and government-issued identification against its database to verify the identity of the individual. Then the applicant is guided through a series of questions, based on information from other sources such as the applicant’s credit report. If the applicant passes the quiz, the credit card payment is processed and the application is electronically submitted to the agency for processing. If the applicant fails at any point in the multilayered authentication process, then the applicant must instead submit a signed, notarized paper application. Massachusetts follows the NIST guidelines which are required in this bill.

1. The IRS hack and KBA. In May 2015, the IRS announced a major data breach in which hackers successfully applied for and received tax refunds for hundreds of thousands of taxpayers. According to recent reports, nearly 700,000 people were affected. Hackers used the IRS’s “Get Transcript” website to steal data from previously filed tax returns and then used that information to file the new, falsified returns.

Privacy advocates have pointed out that the IRS hackers found a way to bypass the two-step process on the IRS’s “Get Transcript” website. In the first step, a user has to provide a Social Security number, date of birth, tax filing status, and street address, according to the IRS. The second step is a KBA quiz that hackers found a way to defeat by guessing the correct answers on thousands of taxpayers. This gave the hackers access to prior returns and enough information to file falsified new returns generating refunds. According to news reports, $50 million in tax refunds were issued and sent by the IRS to a single bank account in Pennsylvania. From there funds were wired to Nigeria and other places.

Unlike the IRS hack in which millions were paid into a single bank account, this bill as amended would require additional security features beyond what NIST requires, including a requirement that the name on the applicant’s credit card must match the name of the applicant, so that a hacker cannot submit thousands of requests using a single credit card.

1. Recent amendments strengthen the bill. The author and stakeholders worked with the Committee to add a number of additional privacy and security protections to the bill, including the following:
   1. A county that chooses to move to electronic requests for vital records must establish a system that meets or exceeds the NIST electronic authentication guideline for multilayered remote identity proofing, as detailed above.
   2. The electronic request system must verify both a valid government-issued identification number and a financial or utility account number. The verification must be conducted by running a match against a state or local agency database or a credit reporting agency or similar database. The verification must confirm that the name, date of birth, address, and other personal information is consistent with the information on the application.
      
   3. The electronic request must or exceeds the information security requirements of the Uniform Electronic Transactions Act and the Federal Information Security Management Act, which require data security risk assessment, risk management and auditing measures to guard against data breach and identity theft.
      
   4. The county must retain records from each electronic verification, as required by the NIST, including the steps taken to verify the applicant’s identity.

The added protections are designed to help reduce the likelihood of fraud and identity theft in the online application process.

1. County option. This bill does not eliminate the paper process in place to apply for an official vital record in California. In fact, the bill provides counties the option of moving to an electronic application system in addition to using the existing paper-based system. Anyone failing the electronic authentication would be required to apply on paper and provide a notarized signature.
   
2. Arguments in support. The Urban Counties of California (UCC) states in support of this bill that “counties process thousands of these types of requests which can be very time consuming for both county staff and consumers. This bill would provide a more user-friendly way to get access to these records through established systems that verify the user’s identity which could provide significant cost savings to counties’ and provide better customer service for these vital records.” UCC states further that the bill “is permissive and is not a mandate which would allow each county to decide whether to make this change. In addition, this bill provides critical consumer protections for privacy by requiring systems that are consistent with federal guidelines which are the most stringent in the country.”

In its letter of support for the bill, the Little Hoover Commission states, “In its 2015 report, A Customer-Centric Upgrade for California Government, the Commission urged state leaders to upgrade and improve state government by sharply focusing on customer needs. The Commission found that, for various reasons, the state does not always make it easy or convenient for Californians to get the government services they are entitled to and deserve. The Commission’s report identified opportunities for improved customer experience across state government, including its vital records program. Certified copies of vital records, such as birth, death and marriage certificates, are critical for Californians who want to enroll their children in school or a youth sports program, apply for a driver’s license or a passport, update their Social Security card to reflect their new married name, or even help settle the affairs of a deceased loved one. While the need for copies of these records is often urgent, the Commission found that the process to obtain them can be overly complicated, time consuming and paper-intensive. To make it easier for Californians to apply for and receive copies of these records, the Commission suggested the state move the application and payment processes online and evaluate whether a notary check is necessary.”

1. Arguments in opposition. Privacy Rights Clearinghouse opposes this bill on the grounds that “the substitution of an electronic acknowledgement for a notarized affidavit will facilitate the ability of identity thieves and other fraudsters to obtain vital records that can then be used to engage in criminal acts against Californians. Certified copies of birth certificates can be used to fraudulently obtain many other important documents such as passports, driver’s licenses, and identification cards.”
2. Prior Legislation. AB 1238 (Linder) of 2015, was similar to this bill and was held on the Assembly Appropriations Committee suspense file.

AB 2275 (Ridley-Thomas) of 2014 was identical to this bill and failed passage in the Senate Judiciary Committee.

AB 464 (Daly), Chapter 78, Statutes of 2013, allowed digitized images, as defined, to be included as part of a request for a certified copy of a birth, death, or marriage record.

AB 130 (Jeffries), Chapter 412, Statutes of 2009, extended the existing limitations on the release and access of birth and death records to marriage records in order to prevent the unauthorized use of personal information.

SB 471 (Margett) of 2007 would have required any individual, authorized by law to obtain a certified copy of a birth or death certificate, to show proof of identification when the request is made in person, except when the individual has been a victim of identity theft. SB 471 died in the Senate Health Committee.

AB 247 (Speier), Chapter 914, Statutes of 2002, authorized the State Registrar, local registrar, or county recorder to provide a certified copy of a birth or death record to an authorized person who submits a statement sworn under penalty of perjury that the requester is signing his or her own legal name and is an authorized person.

1. Double-referral: This bill was double-referred to the Assembly Health Committee where it passed 19-0 on March 29, 2016.
   

REGISTERED SUPPORT / OPPOSITION:

Support

California State Association of Counties (CSAC) (co-sponsor)

Urban Counties of California (UCC) (co-sponsor)

California Association of Clerks and Election Officials

California Association of County Veteran Service Officers

Computing Technology Industry Association (CompTIA)

County Health Executives Association of California (CHEAC)

Little Hoover Commission

Los Angeles County

TechNet

Riverside County

Tarrant County Clerk’s Office

San Bernardino County

Rural County Representatives of California (RCRC)

Opposition

ACLU of California

Privacy Rights Clearinghouse

Analysis Prepared by: Jennie Bretschneider / P. & C.P. / (916) 319-2200

Date of Hearing: March 29, 2016

ASSEMBLY COMMITTEE ON HEALTH

Jim Wood, Chair

ABPCA Bill Id:AB 2636

Author:Linder – As Amended Ver:March 16, 2016

SUBJECT: Certified copies of marriage, birth, and death certificates: electronic application.

SUMMARY: Allows an official, if an electronic request for a certified copy of a birth, death, or marriage record is made, to accept an electronic acknowledgment verifying the identity of the requester using a remote identity proofing process to ensure the requester is an authorized person, as specified. Specifically, this bill:

1. Authorizes the State Registrar, or a local registrar or county recorder to accept electronic acknowledgement, sworn under penalty of perjury, that the requester of a marriage, birth, or death certificate is an authorized person.
2. Requires the electronic request for vital records to utilize a method for the official to establish the identity of the requester using a remote identity proofing process, as specified.
   
3. Requires that the method to process electronic requests and to establish the requester’s identity meet all the following requirements:
   
   1. Be aligned with federal guidelines for security and privacy;
      
   2. Include, at minimum, dynamic knowledge-based authentication or an identity proofing method consistent with the electronic authentication guidelines of the National Institute of Standards and Technology (NIST);
      
   3. Comply with the provisions of the California Uniform Electronic Transactions Act; and,
      
   4. Comply with all other applicable state and federal laws and regulations to protect the personal information of the requester and guard against identity theft.
      
4. Provides that if a requester's identity cannot be established electronically pursuant to 3) above, the requester may accompany his or her request with a notarized statement of identity.

EXISTING LAW:

1. Charges the Office of Vital Records, within the California Department of Public Health, with the responsibility of maintaining a uniform system for registration and a permanent central registry with a comprehensive and continuous index for all birth, death, fetal death, marriage, and dissolution certificates registered for vital events which occur in California.
2. Allows the State Registrar, local registrar, or county recorder to furnish a certified copy of birth, death, or marriage to applicants upon request if:
   1. The request is written, faxed, or a digitized image and accompanied by a notarized statement that is written, faxed, or a digitized image, sworn under penalty of perjury, that the requester is an authorized person, as defined; or,
   2. The request is made in person, and the official takes a statement, sworn under penalty of perjury, that the requester is signing his or her own legal name and is an “authorized person.”
      
3. Defines “authorized person,” for purposes of obtaining certified copies of birth, death, or marriage records, as any of the following:
   1. The person who is the subject of the record or the parent or legal guardian of that person;
      
   2. A party who is entitled to receive the record as a result of a court order;
   3. Law enforcement or governmental agency personnel conducting official business;
   4. A child, grandchild, sibling, spouse, domestic partner, or grandparent of the person who is the subject of the record;
   5. An attorney or other person empowered to act on behalf of the person who is the subject of the record; or,
   6. An agent or employee of a funeral establishment who orders death certificates when acting on behalf of specified individuals.
      
4. Provides that, in all other cases in which the requester does not meet the requirements of an authorized person, a certified copy may be provided to the requester but the document shall be an informational certified copy and shall be redacted to remove any signatures that appear on the document. Requires the certified copy to contain the statement “INFORMATIONAL, NOT A VALID DOCUMENT TO ESTABLISH IDENTITY.”

FISCAL EFFECT: This bill has not been analyzed by a fiscal committee.

COMMENTS:

1. PURPOSE OF THIS BILL. According to the author, individuals seeking vital records in California suffer longer wait times and pay significantly higher fees than individuals seeking records in most other states due to outdated statutes that govern vital records request policies. The author states that county and local staff are significantly burdened by current policies that dictate that a vital records request may only be partially competed online, followed by a notarized affidavit submitted on paper. This hybrid system of online requesting means, practically, that a vital records request cannot be processed without countless of hours of county staff time wasted because staff must manually attach related documents for each individual request as supporting documentation is submitted. The author further asserts that California's policies are drastically out of step with national trends to increase access to vital government services through online technologies, as 34 other states and 171 local jurisdictions allow for digital authentication of vital records requests online as a standard matter of practice.
2. BACKGROUND. The Office of Vital Records is charged with the responsibility of maintaining a uniform system for registration and a permanent central registry with a comprehensive and continuous index for all birth, death, fetal death, marriage, and dissolution certificates registered for vital events which occur in California. Certified copies of these records are available from the State Registrar, the 58 county recorders, and 61 local health jurisdictions.
3. ELECTRONIC AUTHENTICATION GUIDELINES. Electronic authentication (e-authentication) is the process of establishing confidence in user identities electronically presented to an information system. E-authentication presents a technical challenge when this process involves the remote authentication of individual people over an open network (i.e. the internet), for the purpose of electronic government and commerce. The NIST, under the U.S. Department of Commerce, released guidelines in 2013 to provide technical guidance to agencies to allow an individual to remotely authenticate his or her identity to a federal IT system. These guidelines address only traditional, widely implemented methods for remote authentication based on secrets. With these methods, the individual whose identity is authenticated proves that he or she knows or possesses some secret information.
4. EXECUTIVE ORDER ON SECURING CONSUMER DATA ONLINE. In response to several high profile consumer data breaches, potentially leading to credit card fraud and identity crimes, President Obama issued an executive order on October 17, 2014, aimed at improving the security of consumer financial transactions. The Executive Order states that "given that identity crimes, including credit, debit, and other payment card fraud, continue to be a risk to U.S. economic activity, and given the economic consequences of data breaches, the United States must take further action to enhance the security of data in the financial marketplace. While the U.S. Government's credit, debit, and other payment card programs already include protections against fraud, the Government must further strengthen the security of consumer data and encourage the adoption of enhanced safeguards nationwide in a manner that protects privacy and confidentiality while maintaining an efficient and innovative financial system." In part, the order directed the National Security Council staff, the Office of Science and Technology Policy, and Office of Management and Budget to present to the President by March, 2016 a plan to ensure that all agencies making personal data accessible to citizens through digital applications require the use of multiple factors of authentication and an effective identity proofing process, as appropriate.
5. SUPPORT. The Urban Counties Caucus, cosponsor of this bill, writes in support that counties process thousands of these types of requests which can be very time consuming for both county staff and consumers. This bill would provide a more user-friendly way to get access to these records through established systems that verify the user’s identity which could provide significant cost savings to counties and provide better customer service. The California State Association of Counties, cosponsor of the bill, states that updating vital records requests could also reduce the overall cost for consumers when obtaining vital records. The current fee for a certified copy of a birth certificate in Los Angeles County ranges from $23 to $28, and the average notary fee is an additional $20.
6. OPPOSITION. Privacy Rights Clearinghouse (PRC) opposes on the grounds that substitution of an electronic acknowledgement for a notarized affidavit will facilitate the ability of identity thieves and other fraudsters to obtain vital records that can then be used to engage in criminal acts against Californians. Vital records contain a wealth of personal information, which if inappropriately released to the wrong person can result in significant privacy violations. PRC further states that any legislation expanding the ability to obtain vital records online much have sufficient protections in place to protect Californians' sensitive personal information and prevent identity theft and other fraudulent activity.
7. PREVIOUS LEGISLATION.
   1. AB 1238 (Linder) of 2015, substantially similar to this bill, was held in the Assembly Appropriations Committee suspense file.
   2. AB 2275 (Ridley-Thomas) of 2014 was identical to this bill and failed passage in the Senate Judiciary Committee.
   3. AB 464 (Daly), Chapter 78, Statutes of 2013, allows digitized images, as defined, to be included as part of a request for a certified copy of a birth, death, or marriage record.
   4. AB 130 (Jeffries), Chapter 412, Statutes of 2009, extends the existing limitations on the release and access of birth and death records to marriage records in order to prevent the unauthorized use of personal information.
   5. SB 471 (Margett) of 2007 would have required any individual, authorized by law to obtain a certified copy of a birth or death certificate, to show proof of identification when the request is made in person, except when the individual has been a victim of identity theft. SB 471 died in the Senate Health Committee.
   6. AB 247 (Speier), Chapter 914, Statutes of 2002, authorizes the State Registrar, local registrar, or county recorder to provide a certified copy of a birth or death record to an authorized person who submits a statement sworn under penalty of perjury that the requester is signing his or her own legal name and is an authorized person.
8. DOUBLE REFERRAL. This bill is double referred. Upon passage of this Committee, this bill will be referred to the Assembly Committee on Privacy and Consumer Protection.
9. POLICY COMMENT. Vital records contain a wealth of personal information, which if inappropriately released to the wrong person could result in a significant violation of privacy. Privacy is protected by California's Constitution, and must be protected with the highest possible standards. Certified copies of birth certificates can be used to fraudulently obtain many other important documents such as passports, driver’s licenses, and identification cards. Certified copies of death certificates can be used to fraudulently obtain decedents’ death benefits, including life insurance proceeds and investment accounts. Given the inherent difficulties in verifying the identity of an individual over the Internet, and the countless opportunities for identity theft that vital records in the wrong hands could create, very strong protections must be in place to ensure that vital records are safely maintained. The committee may wish to consider whether the security standards set forth in this bill are sufficient to protect against identity theft.

REGISTERED SUPPORT / OPPOSITION:

Support

California State Association of Counties (cosponsor)

Urban Counties Caucus (cosponsor)

California Association of Clerks and Election Officials

California Association of County Veteran Service Officers

Computing Technology Industry Association

County Health Executives Association of California

County of San Bernardino

Little Hoover Commission

Los Angeles County Board of Supervisors

Riverside County Board of Supervisors
Rural County Representatives of California

TechNet

Opposition

Privacy Rights Clearinghouse

Analysis Prepared by: Dharia McGrew / HEALTH / (916) 319-2097