AB 1742: Consumer credit reporting agencies: security freeze requests.
- Session Year: 2017-2018
- House: Assembly
- Latest Version Date: 2018-05-03
The Consumer Credit Reporting Agencies Act authorizes a consumer to place a security freeze on his or her credit report by making a request in writing by mail to a consumer credit reporting agency. That act requires a consumer credit reporting agency to place the security freeze on the consumers credit report no later than 3 business days after receiving the consumers request and to send a written confirmation of the security freeze to the consumer within 10 business days. The act also generally requires a consumer credit reporting agency, upon consumer request, to temporarily lift or remove a freeze, subject to receiving proper identification, and satisfying other conditions.
This bill would permit a consumer to request a security freeze, a temporary lift of a security freeze, and removal of a security freeze electronically. The bill would require a consumer credit reporting agency that receives such an electronic request to comply with the request not later than 15 minutes after receiving the request. agency, not later than 15 minutes after authenticating a request that was received electronically, and in no event later than 24 hours after receiving a request electronically from a consumer, to place a security freeze on the consumers credit report and offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies, as specified. The bill would also require a consumer credit reporting agency that receives a security freeze request, a request for temporary lift of a freeze, freeze or a request for removal of a freeze, within 3 business days after receipt of the request by mail, or within 15 minutes after receipt of the request electronically, to comply with the request and offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. The bill would require the consumer credit reporting agency, if the consumer accepts the offer, to submit the request to the consumer credit reporting agencies within specified periods of time, subject to receipt of proper identification, as specified. The bill would require a consumer reporting agency that receives a request on the consumers behalf from another agency to comply with the request within 15 minutes.
The Consumer Credit Reporting Agencies Act authorizes a consumer to place a security freeze on his or her credit report by making a request in writing by mail to a consumer credit reporting agency. That act requires a consumer credit reporting agency to place the security freeze on the consumers credit report no later than 3 business days after receiving the consumers request and to send a written confirmation of the security freeze to the consumer within 10 business days. The act also generally requires a consumer credit reporting agency, upon consumer request, to temporarily lift or remove a freeze, subject to receiving proper identification, and satisfying other conditions.
This bill would permit a consumer to request a security freeze, a temporary lift of a security freeze, and removal of a security freeze electronically. The bill would require a consumer credit reporting agency that receives such an electronic request to comply with the request not later than 15 minutes after receiving the request. The bill would also require a consumer credit reporting agency that receives a security freeze request, a request for temporary lift of a freeze, or a request for removal of a freeze in writing by mail, freeze, within 3 business days after receipt of the request, request by mail, or within 15 minutes after receipt of the request electronically, to offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. The bill would require the consumer credit reporting agency, if the consumer accepts, accepts the offer, to submit the request to the consumer credit reporting agencies within 3 business days, specified periods of time, subject to receipt of proper identification, as specified. The bill would require a consumer reporting agency that receives a request on the consumers behalf from another agency to comply with the request within 15 minutes.
The bill would also permit a consumer to place a security freeze request on his or her credit report electronically. The bill would require a consumer credit reporting agency, in those circumstances, not later than 15 minutes upon receiving an electronic request from a consumer, to place a security freeze on the consumers credit report and offer to submit that freeze on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. The bill would permit a consumer to temporarily lift a freeze or remove a freeze by making a request electronically and would require a consumer credit reporting agency to process the request not later than 15 minutes upon receiving the consumers request, subject to receipt of proper identification. The bill would make related and conforming changes to those provisions.
The Consumer Credit Reporting Agencies Act authorizes a consumer to place a security freeze on his or her credit report by making a request in writing by mail to a consumer credit reporting agency. That act requires a consumer credit reporting agency to place the security freeze on the consumers credit report no later than 3 business days after receiving the consumers request and to send a written confirmation of the security freeze to the consumer within 10 business days. The act also generally requires a consumer credit reporting agency, upon consumer request, to temporarily lift or remove a freeze, subject to receiving proper identification, and satisfying other conditions.
This bill would additionally require a consumer credit reporting agency that receives a security freeze request, a request for temporary lift of a freeze, or a request for removal of a freeze, freeze in writing by mail, within 3 business days after receipt of the request, to offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. The bill would require the consumer credit reporting agency, if the consumer accepts, to submit the request to the consumer credit reporting agencies within 3 business days, subject to receipt of proper identification, as specified.
The bill would also permit a consumer to place a security freeze request on his or her credit report electronically. The bill would require a consumer credit reporting agency, in those circumstances, not later than 15 minutes upon receiving an electronic request from a consumer, to place a security freeze on the consumers credit report and offer to submit that freeze on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. The bill would permit a consumer to temporarily lift a freeze or remove a freeze by making a request electronically and would require a consumer credit reporting agency to process the request not later than 15 minutes upon receiving the consumers request, subject to receipt of proper identification. The bill would make related and conforming changes to those provisions.
The Consumer Credit Reporting Agencies Act authorizes a consumer to place a security freeze on his or her credit report by making a request in writing by mail to a consumer credit reporting agency. That act requires a consumer credit reporting agency to place the security freeze on the consumers credit report no later than 3 business days after receiving the consumers request and to send a written confirmation of the security freeze to the consumer within 10 business days. The act also generally requires a consumer credit reporting agency, upon consumer request, to temporarily lift or remove a freeze, subject to receiving proper identification, and satisfying other conditions.
This bill would additionally require a consumer credit reporting agency that receives a security freeze request, a request for temporary lift of a freeze, or a request for removal of a freeze, within 3 business days after receipt of the request, to offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. The bill would require the consumer credit reporting agency, if the consumer accepts, to submit the request to the consumer credit reporting agencies within 3 business days, subject to receipt of proper identification, as specified.
(a)A consumer may elect to place a security freeze on his or her credit report by making a request in writing by mail or electronically to a consumer credit reporting agency. Security freeze means a notice placed in a consumers credit report, at the request of the consumer, and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumers credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumers credit report may not be released to a third party without prior express authorization from the consumer. This subdivision does not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumers credit report.
(b)(1)Except as provided in paragraph (2), not later than three business days after receiving a written request by mail from a consumer, a consumer credit reporting agency shall do both of the following:
(A)Place a security freeze on the consumers credit report.
(B)Offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days of receipt if the consumers acceptance is received by mail, and within 15 minutes of receipt if the consumers acceptance is received electronically, subject to receipt of proper identification, as defined in subdivision (c) of Section 1785.15. Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(2)Notwithstanding paragraph (1), not later than 15 minutes after receiving authenticating a request that was received electronically from a consumer, and in no event later than 24 hours after receiving a request electronically from a consumer, a consumer credit reporting agency shall do both of the following:
(A)Place a security freeze on the consumers credit report.
(B)Offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within 15 minutes of receipt of the consumers acceptance, subject to receipt of proper identification, as defined in subdivision (c) of Section 1785.15. Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(c)The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit for a specific party or period of time.
(d)(1)If the consumer wishes to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place, he or she shall contact the consumer credit reporting agency, request that the freeze be temporarily lifted, and provide the following:
(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(C)The proper information regarding the third party who is to receive the credit report or the time period for which the report shall be available to users of the credit report.
(2)Not later than three business days after receiving a written request by mail from a consumer for a temporary lift of a security freeze, and not later than 15 minutes after receiving such a request electronically, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days of receipt if the consumers acceptance is received by mail, and within 15 minutes of receipt if the consumers acceptance is received electronically, subject to receipt of the information specified in subparagraphs (A) to (C), inclusive, of paragraph (1). Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(e) (1)Except as provided in paragraph (2), a consumer credit reporting agency that receives a written request from a consumer to temporarily lift a freeze on a credit report pursuant to subdivision (d) shall comply with the request no later than three business days after receiving the request.
(2)Notwithstanding paragraph (1), a consumer credit reporting agency that receives a request from a consumer electronically to temporarily lift a freeze on a credit report pursuant to subdivision (d) shall comply with the request not later than 15 minutes after receiving the request.
(f) A consumer credit reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request in an expedited manner.
(g) A consumer credit reporting agency shall remove or temporarily lift a freeze placed on a consumers credit report only in the following cases:
(1)Upon consumer request, pursuant to subdivision (d) or (j).
(2)If the consumers credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a freeze upon a consumers credit report pursuant to this paragraph, the consumer credit reporting agency shall notify the consumer in writing prior to removing the freeze on the consumers credit report.
(3)Upon request from a consumer credit reporting agency made on behalf of a consumer pursuant to subdivision (d) or (j).
(h) A third party who requests access to a consumer credit report in connection with an application for credit or any other use may treat the application as incomplete if a security freeze is in effect and the consumer does not allow his or her credit report to be accessed for that specific party or period of time.
(i) If a consumer requests a security freeze, the consumer credit reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumers credit report for a specific party or period of time while the freeze is in place.
(j) (1)A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer credit reporting agency shall remove a security freeze within three business days of receiving a written request by mail for removal from the consumer if the consumer provides both of the following:
(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(2)Not later than three business days after receiving a written consumer request by mail to remove a security freeze, and not later than 15 minutes after receiving such a request electronically, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days of receipt if the consumers acceptance is received by mail, and within 15 minutes of receipt if the consumers acceptance is received electronically, subject to receipt of proper identification, as specified in subparagraphs (A) and (B) of paragraph (1). Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(3)Notwithstanding paragraphs (1) and (2), a consumer credit reporting agency that receives a request electronically from a consumer to remove a security freeze shall comply with the request not later than 15 minutes after receiving the request, subject to the consumer providing the identification set forth in subparagraphs (A) and (B) of paragraph (1).
(k) A consumer credit reporting agency shall require proper identification, as defined in subdivision (c) of Section 1785.15, of the person making a request to place or remove a security freeze.
(l)The provisions of this section do not apply to the use of a consumer credit report by any of the following:
(1)(A)(i)A person or entity with which the consumer has or had, prior to any assignment, an account or contract, including a demand deposit account, or to which the consumer issued a negotiable instrument, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(ii)A subsidiary, affiliate, or agent of a person or entity described in clause (i), an assignee of a financial obligation owing by the consumer to such a person or entity, or a prospective assignee of a financial obligation owing by the consumer to such a person or entity in conjunction with the proposed purchase of the financial obligation, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(B)For purposes of this paragraph, reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
(2)A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subdivision (d) for purposes of facilitating the extension of credit or other permissible use.
(3)Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
(4)A child support agency acting pursuant to Chapter 2 (commencing with Section 17400) of Division 17 of the Family Code or Title IV-D of the Social Security Act (42 U.S.C. Sec. 651 et seq.).
(5)The State Department of Health Care Services or its agents or assigns acting to investigate Medi-Cal fraud.
(6)The Franchise Tax Board or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.
(7)The use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act.
(8)Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed.
(9)Any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumers request.
(m)(1)Except as provided in paragraph (2), this title does not prevent a consumer credit reporting agency from charging a fee of no more than ten dollars ($10) to a consumer for the placement of each freeze, the removal of the freeze, the temporary lift of the freeze for a period of time, or the temporary lift of the freeze for a specific party, regarding access to a consumer credit report, except that a consumer credit reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report or valid Department of Motor Vehicles investigative report that alleges a violation of Section 530.5 of the Penal Code.
(2)With respect to a consumer who is 65 years of age or older and who has provided identification confirming his or her age, a consumer credit reporting agency shall not charge a fee for the placement of an initial security freeze, but may charge a fee not to exceed five dollars ($5) for the removal of the freeze, the temporary lift of the freeze for a period of time, the temporary lift of the freeze for a specific party, or replacing the freeze.
(n)Regardless of the existence of a security freeze, a consumer credit reporting agency may disclose public record information lawfully obtained by, or for, the consumer credit reporting agency from an open public record to the extent otherwise permitted by law. This subdivision does not prohibit a consumer credit reporting agency from electing to apply a valid security freeze to the entire contents of a credit report.
(a)A consumer may elect to place a security freeze on his or her credit report by making a request in writing by mail or electronically to a consumer credit reporting agency. Security freeze means a notice placed in a consumers credit report, at the request of the consumer, and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumers credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumers credit report may not be released to a third party without prior express authorization from the consumer. This subdivision does not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumers credit report.
(b)(1)Not Except as provided in paragraph (2), not later than three business days after receiving a written request by mail from a consumer, a consumer credit reporting agency shall do both of the following:
(A)Place a security freeze on the consumers credit report.
(B)Offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, days of receipt if the consumers acceptance is received by mail, and within 15 minutes of receipt if the consumers acceptance is received electronically, subject to receipt of proper identification, as defined in subdivision (c) of Section 1785.15. Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(2)Notwithstanding paragraph (1), not later than 15 minutes upon after receiving a request electronically from a consumer, a consumer credit reporting agency shall do both of the following:
(A)Place a security freeze on the consumers credit report.
(B)Offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within 15 minutes of receipt of the consumers request. acceptance, subject to receipt of proper identification, as defined in subdivision (c) of Section 1785.15. Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(c)The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit for a specific party or period of time.
(d)(1)If the consumer wishes to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place, he or she shall contact the consumer credit reporting agency, request that the freeze be temporarily lifted, and provide the following:
(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(C)The proper information regarding the third party who is to receive the credit report or the time period for which the report shall be available to users of the credit report.
(2)Not later than three business days after receiving a written request by mail from a consumer for a temporary lift of a security freeze, and not later than 15 minutes upon after receiving such a request electronically, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, and if the request was received in writing within 15 minutes if the request was received electronically, days of receipt if the consumers acceptance is received by mail, and within 15 minutes of receipt if the consumers acceptance is received electronically, subject to receipt of the information specified in subparagraphs (A) to (C), inclusive, of paragraph (1). Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(e) (1)A Except as provided in paragraph (2), a consumer credit reporting agency that receives a written request from a consumer to temporarily lift a freeze on a credit report pursuant to subdivision (d) shall comply with the request no later than three business days after receiving the request.
(2)Notwithstanding paragraph (1), a consumer credit reporting agency that receives a request from a consumer electronically to temporarily lift a freeze on a credit report pursuant to subdivision (d) shall comply with the request not later than 15 minutes upon after receiving the request.
(f) A consumer credit reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request in an expedited manner.
(g) A consumer credit reporting agency shall remove or temporarily lift a freeze placed on a consumers credit report only in the following cases:
(1)Upon consumer request, pursuant to subdivision (d) or (j).
(2)If the consumers credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a freeze upon a consumers credit report pursuant to this paragraph, the consumer credit reporting agency shall notify the consumer in writing prior to removing the freeze on the consumers credit report.
(3)Upon request from a consumer credit reporting agency made on behalf of a consumer pursuant to subdivision (d) or (j).
(h) A third party who requests access to a consumer credit report in connection with an application for credit or any other use may treat the application as incomplete if a security freeze is in effect and the consumer does not allow his or her credit report to be accessed for that specific party or period of time.
(i) If a consumer requests a security freeze, the consumer credit reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumers credit report for a specific party or period of time while the freeze is in place.
(j) (1)A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer credit reporting agency shall remove a security freeze within three business days of receiving a written request by mail for removal from the consumer if the consumer provides both of the following:
(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(2)Not later than three business days after receiving a written consumer request by mail to remove a security freeze, and not later than 15 minutes after receiving such a request electronically, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, days of receipt if the consumers acceptance is received by mail, and within 15 minutes of receipt if the consumers acceptance is received electronically, subject to receipt of proper identification, as specified in subparagraphs (A) and (B) of paragraph (1). Within 15 minutes of receiving the request from a consumer credit reporting agency on the consumers behalf, a consumer credit reporting agency shall comply with the request.
(3)Notwithstanding paragraphs (1) and (2), a consumer credit reporting agency that receives a request electronically from a consumer to remove a security freeze shall comply with the request not later than 15 minutes after receiving the request, subject to the consumer providing the identification set forth in subparagraphs (A) and (B) of paragraph (1).
(k) A consumer credit reporting agency shall require proper identification, as defined in subdivision (c) of Section 1785.15, of the person making a request to place or remove a security freeze.
(l)The provisions of this section do not apply to the use of a consumer credit report by any of the following:
(1)(A)(i)A person or entity with which the consumer has or had, prior to any assignment, an account or contract, including a demand deposit account, or to which the consumer issued a negotiable instrument, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(ii)A subsidiary, affiliate, or agent of a person or entity described in clause (i), an assignee of a financial obligation owing by the consumer to such a person or entity, or a prospective assignee of a financial obligation owing by the consumer to such a person or entity in conjunction with the proposed purchase of the financial obligation, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(B)For purposes of this paragraph, reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
(2)A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subdivision (d) for purposes of facilitating the extension of credit or other permissible use.
(3)Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
(4)A child support agency acting pursuant to Chapter 2 (commencing with Section 17400) of Division 17 of the Family Code or Title IV-D of the Social Security Act (42 U.S.C. Sec. 651 et seq.).
(5)The State Department of Health Care Services or its agents or assigns acting to investigate Medi-Cal fraud.
(6)The Franchise Tax Board or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.
(7)The use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act.
(8)Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed.
(9)Any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumers request.
(m)(1)Except as provided in paragraph (2), this title does not prevent a consumer credit reporting agency from charging a fee of no more than ten dollars ($10) to a consumer for the placement of each freeze, the removal of the freeze, the temporary lift of the freeze for a period of time, or the temporary lift of the freeze for a specific party, regarding access to a consumer credit report, except that a consumer credit reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report or valid Department of Motor Vehicles investigative report that alleges a violation of Section 530.5 of the Penal Code.
(2)With respect to a consumer who is 65 years of age or older and who has provided identification confirming his or her age, a consumer credit reporting agency shall not charge a fee for the placement of an initial security freeze, but may charge a fee not to exceed five dollars ($5) for the removal of the freeze, the temporary lift of the freeze for a period of time, the temporary lift of the freeze for a specific party, or replacing the freeze.
(n)Regardless of the existence of a security freeze, a consumer credit reporting agency may disclose public record information lawfully obtained by, or for, the consumer reporting agency from an open public record to the extent otherwise permitted by law. This subdivision does not prohibit a consumer reporting agency from electing to apply a valid security freeze to the entire contents of a credit report.
(a)A consumer may elect to place a security freeze on his or her credit report by making a request in writing by mail or electronically to a consumer credit reporting agency. Security freeze means a notice placed in a consumers credit report, at the request of the consumer, and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumers credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumers credit report may not be released to a third party without prior express authorization from the consumer. This subdivision does not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumers credit report.
(b)Not (b)(1)Not later than three business days after receiving a written request by mail from a consumer, a consumer credit reporting agency shall do both of the following:
(1)(A)Place a security freeze on the consumers credit report.
(2)(B)Offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, subject to receipt of proper identification, as defined in subdivision (c) of Section 1785.15.
(2)Notwithstanding paragraph (1), not later than 15 minutes upon receiving a request electronically from a consumer, a consumer credit reporting agency shall do both of the following:
(A)Place a security freeze on the consumers credit report.
(B)Offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within 15 minutes of receipt of the consumers request.
(c)The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit for a specific party or period of time.
(d)(1)If the consumer wishes to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place, he or she shall contact the consumer credit reporting agency, request that the freeze be temporarily lifted, and provide the following:
(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(C)The proper information regarding the third party who is to receive the credit report or the time period for which the report shall be available to users of the credit report.
(2)Not later than three business days after receiving a written request by mail from a consumer for a temporary lift of a security freeze, and not later than 15 minutes upon receiving such a request electronically, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, and if the request was received in writing within 15 minutes if the request was received electronically, subject to receipt of the information specified in subparagraphs (A) to (C), inclusive, of paragraph (1).
(e) (1)A consumer credit reporting agency that receives a written request from a consumer to temporarily lift a freeze on a credit report pursuant to subdivision (d) shall comply with the request no later than three business days after receiving the request.
(2)Notwithstanding paragraph (1), a consumer credit reporting agency that receives a request from a consumer electronically to temporarily lift a freeze on a credit report pursuant to subdivision (d) shall comply with the request not later than 15 minutes upon receiving the request.
(f) A consumer credit reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subdivision (d) in an expedited manner.
(g) A consumer credit reporting agency shall remove or temporarily lift a freeze placed on a consumers credit report only in the following cases:
(1)Upon consumer request, pursuant to subdivision (d) or (j).
(2)If the consumers credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a freeze upon a consumers credit report pursuant to this paragraph, the consumer credit reporting agency shall notify the consumer in writing prior to removing the freeze on the consumers credit report.
(3)Upon request from a consumer credit reporting agency made on behalf of a consumer pursuant to subdivision (d) or (j).
(h) A third party who requests access to a consumer credit report in connection with an application for credit or any other use may treat the application as incomplete if a security freeze is in effect and the consumer does not allow his or her credit report to be accessed for that specific party or period of time.
(i) If a consumer requests a security freeze, the consumer credit reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumers credit report for a specific party or period of time while the freeze is in place.
(j) (1)A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer credit reporting agency shall remove a security freeze within three business days of receiving a written request by mail for removal from the consumer if the consumer provides both of the following:
(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(2)Not later than three business days after receiving a consumer request to remove a security freeze, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, subject to receipt of proper identification, as specified in subparagraphs (A) and (B) of paragraph (1).
(3)Notwithstanding paragraphs (1) and (2), a consumer credit reporting agency that receives a request electronically from a consumer to remove a security freeze shall comply with the request not later than 15 minutes after receiving the request, subject to the consumer providing the identification set forth in subparagraphs (A) and (B) of paragraph (1).
(k) A consumer credit reporting agency shall require proper identification, as defined in subdivision (c) of Section 1785.15, of the person making a request to place or remove a security freeze.
(l)The provisions of this section do not apply to the use of a consumer credit report by any of the following:
(1)(A)(i)A person or entity with which the consumer has or had, prior to any assignment, an account or contract, including a demand deposit account, or to which the consumer issued a negotiable instrument, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(ii)A subsidiary, affiliate, or agent of a person or entity described in clause (i), an assignee of a financial obligation owing by the consumer to such a person or entity, or a prospective assignee of a financial obligation owing by the consumer to such a person or entity in conjunction with the proposed purchase of the financial obligation, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(B)For purposes of this paragraph, reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
(2)A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subdivision (d) for purposes of facilitating the extension of credit or other permissible use.
(3)Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
(4)A child support agency acting pursuant to Chapter 2 (commencing with Section 17400) of Division 17 of the Family Code or Title IV-D of the Social Security Act (42 U.S.C. Sec. 651 et seq.).
(5)The State Department of Health Care Services or its agents or assigns acting to investigate Medi-Cal fraud.
(6)The Franchise Tax Board or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.
(7)The use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act.
(8)Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed.
(9)Any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumers request.
(m)(1)Except as provided in paragraph (2), this title does not prevent a consumer credit reporting agency from charging a fee of no more than ten dollars ($10) to a consumer for the placement of each freeze, the removal of the freeze, the temporary lift of the freeze for a period of time, or the temporary lift of the freeze for a specific party, regarding access to a consumer credit report, except that a consumer credit reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report or valid Department of Motor Vehicles investigative report that alleges a violation of Section 530.5 of the Penal Code.
(2)With respect to a consumer who is 65 years of age or older and who has provided identification confirming his or her age, a consumer credit reporting agency shall not charge a fee for the placement of an initial security freeze, but may charge a fee not to exceed five dollars ($5) for the removal of the freeze, the temporary lift of the freeze for a period of time, the temporary lift of the freeze for a specific party, or replacing the freeze.
(n)Regardless of the existence of a security freeze, a consumer credit reporting agency may disclose public record information lawfully obtained by, or for, the consumer reporting agency from an open public record to the extent otherwise permitted by law. This subdivision does not prohibit a consumer reporting agency from electing to apply a valid security freeze to the entire contents of a credit report.
(a)A consumer may elect to place a security freeze on his or her credit report by making a request in writing by mail to a consumer credit reporting agency. Security freeze means a notice placed in a consumers credit report, at the request of the consumer, and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumers credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumers credit report may not be released to a third party without prior express authorization from the consumer. This subdivision does not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumers credit report.
(b)A consumer credit reporting agency shall place a security freeze on a consumers credit report no Not later than three business days after receiving a written request from the consumer. a consumer, a consumer credit reporting agency shall do both of the following:
(1)Place a security freeze on the consumers credit report.
(2)Offer to submit a security freeze request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, subject to receipt of proper identification, as defined in subdivision (c) of Section 1785.15.
(c)The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit for a specific party or period of time.
(d)(1)If the consumer wishes to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place, he or she shall contact the consumer credit reporting agency, request that the freeze be temporarily lifted, and provide the following:
(1)(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(2)(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(3)(C)The proper information regarding the third party who is to receive the credit report or the time period for which the report shall be available to users of the credit report.
(2)Not later than three business days after receiving a request from a consumer for a temporary lift of a security freeze, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, subject to receipt of the information specified in subparagraphs (A) to (C), inclusive, of paragraph (1).
(e) A consumer credit reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report pursuant to subdivision (d) shall comply with the request no later than three business days after receiving the request.
(f) A consumer credit reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subdivision (d) in an expedited manner.
(g) A consumer credit reporting agency shall remove or temporarily lift a freeze placed on a consumers credit report only in the following cases:
(1)Upon consumer request, pursuant to subdivision (d) or (j).
(2)If the consumers credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a freeze upon a consumers credit report pursuant to this paragraph, the consumer credit reporting agency shall notify the consumer in writing prior to removing the freeze on the consumers credit report.
(3)Upon request from a consumer credit reporting agency made on behalf of a consumer pursuant to subdivision (d) or (j).
(h) A third party who requests access to a consumer credit report in connection with an application for credit or any other use may treat the application as incomplete if a security freeze is in effect and the consumer does not allow his or her credit report to be accessed for that specific party or period of time.
(i) If a consumer requests a security freeze, the consumer credit reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumers credit report for a specific party or period of time while the freeze is in place.
(j) (1)A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer credit reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer if the consumer provides both of the following:
(1)(A)Proper identification, as defined in subdivision (c) of Section 1785.15.
(2)(B)The unique personal identification number or password provided by the credit reporting agency pursuant to subdivision (c).
(2)Not later than three business days after receiving a consumer request to remove a security freeze, the consumer credit reporting agency shall offer to submit that request on the consumers behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, the consumer credit reporting agency shall submit the request to those consumer credit reporting agencies within three business days, subject to receipt of proper identification, as specified in subparagraphs (A) and (B) of paragraph (1).
(k) A consumer credit reporting agency shall require proper identification, as defined in subdivision (c) of Section 1785.15, of the person making a request to place or remove a security freeze.
(l)The provisions of this section do not apply to the use of a consumer credit report by any of the following:
(1)(A)(i)A person or entity with which the consumer has or had, prior to any assignment, an account or contract, including a demand deposit account, or to which the consumer issued a negotiable instrument, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(ii)A subsidiary, affiliate, or agent of a person or entity described in clause (i), an assignee of a financial obligation owing by the consumer to such a person or entity, or a prospective assignee of a financial obligation owing by the consumer to such a person or entity in conjunction with the proposed purchase of the financial obligation, for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(B)For purposes of this paragraph, reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
(2)A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subdivision (d) for purposes of facilitating the extension of credit or other permissible use.
(3)Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
(4)A child support agency acting pursuant to Chapter 2 (commencing with Section 17400) of Division 17 of the Family Code or Title IV-D of the Social Security Act (42 U.S.C. Sec. 651 et seq.).
(5)The State Department of Health Care Services or its agents or assigns acting to investigate Medi-Cal fraud.
(6)The Franchise Tax Board or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.
(7)The use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act.
(8)Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed.
(9)Any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumers request.
(m)(1)Except as provided in paragraph (2), this title does not prevent a consumer credit reporting agency from charging a fee of no more than ten dollars ($10) to a consumer for the placement of each freeze, the removal of the freeze, the temporary lift of the freeze for a period of time, or the temporary lift of the freeze for a specific party, regarding access to a consumer credit report, except that a consumer credit reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report or valid Department of Motor Vehicles investigative report that alleges a violation of Section 530.5 of the Penal Code.
(2)With respect to a consumer who is 65 years of age or older and who has provided identification confirming his or her age, a consumer credit reporting agency shall not charge a fee for the placement of an initial security freeze, but may charge a fee not to exceed five dollars ($5) for the removal of the freeze, the temporary lift of the freeze for a period of time, the temporary lift of the freeze for a specific party, or replacing the freeze.
(n)Regardless of the existence of a security freeze, a consumer reporting agency may disclose public record information lawfully obtained by, or for, the consumer reporting agency from an open public record to the extent otherwise permitted by law. This subdivision does not prohibit a consumer reporting agency from electing to apply a valid security freeze to the entire contents of a credit report.
|
Date
|
Status
|
|---|---|
| May 24, 2018 | Referred to Com. on JUD. |
| May 10, 2018 | In Senate. Read first time. To Com. on RLS. for assignment. |
| May 10, 2018 | Read third time. Passed. Ordered to the Senate. |
| May 7, 2018 | Read second time. Ordered to third reading. |
| May 3, 2018 | Read second time and amended. Ordered returned to second reading. |
| May 2, 2018 | From committee: Amend, and do pass as amended. (Ayes 10. Noes 0.) (May 1). |
| Apr 17, 2018 | From committee: Do pass and re-refer to Com. on P. & C.P. (Ayes 8. Noes 1.) (April 16). Re-referred to Com. on P. & C.P. |
| Apr 12, 2018 | Re-referred to Com. on B. & F. |
| Apr 11, 2018 | From committee chair, with author's amendments: Amend, and re-refer to Com. on B. & F. Read second time and amended. |
| Mar 8, 2018 | Re-referred to Com. on B. & F. |
| Mar 7, 2018 | From committee chair, with author's amendments: Amend, and re-refer to Com. on B. & F. Read second time and amended. |
| Jan 16, 2018 | Referred to Coms. on B. & F. and P. & C.P. |
| Jan 4, 2018 | From printer. May be heard in committee February 3. |
| Jan 3, 2018 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| May 10, 2018 | AB 1742 QUIRK Assembly Third Reading | Assembly Floor |
Passed |
|
| May 1, 2018 | Do pass as amended. | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
|
| Apr 16, 2018 | Do pass and be re-referred to the Committee on [Privacy and Consumer Protection] | Assembly Standing Committee on Banking and Finance |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| California District Attorneys Association | ** Support | Apr 27, 2018 |
| California Senior Legislature | ** Support | Apr 27, 2018 |
| Consumer Data Industry Association | ** Against | Apr 27, 2018 |
| Consumers Union | * Support | May 1, 2018 |
ASSEMBLY THIRD READING
ATR Bill Id:AB 1742
Author:(Quirk)
As Amended Ver:May 3, 2018
Majority vote
Committee | Votes | Ayes | Noes |
Banking | 8-1 | Limón, Calderon, Berman, Choi, Gonzalez Fletcher, Grayson, Mark Stone, Weber | Acosta |
Privacy | 10-0 | Chau, Kiley, Baker, Berman, Calderon, Irwin, Mullin, Obernolte, Reyes, Ting |
SUMMARY: Streamlines the process for consumers to request credit freezes from consumer credit reporting agencies (CCRA). Specifically, this bill:
- Requires a CCRA to place, temporarily lift, or remove a security freeze on a consumer's credit file within 15 minutes of receiving a request electronically from the consumer, subject to receipt of proper identification.
- Requires a CCRA to offer to submit a security freeze request on behalf of a consumer to all CCRAs that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, a CCRA is required to submit the request to those consumer credit reporting agencies within 15 minutes of receiving a consumer's acceptance electronically and within three days of receiving a consumer's acceptance by mail.
FISCAL EFFECT: None
COMMENTS:
In response to the Equifax breach, consumer protection advocates and state regulators, including the California Department of Business Oversight and the California Attorney General, recommended that consumers consider placing a security freeze on their credit files. A security freeze is among the strongest actions that a consumer can take to protect himself or herself from the risk of a fraudulent credit account being issued using the consumer's stolen information. Prior to opening a new credit line when a credit freeze is in place, a consumer must provide proper identification, including a unique personal identification number or password provided by the CCRA, with a request to the CCRA to temporarily lift or remove the security freeze.
According to consumer advocates who support the bill, this bill increases consumer protections by making it easier for consumers to manage the security freeze and to access credit when the consumer chooses to apply for a new credit card, apartment, or car loan. This bill also adds a provision for setting, lifting, and removing the freeze with an electronic request. Guaranteeing consumers more power to manage how this information is shared is particularly important, because consumers have no control over how their financial information is collected by CCRAs.
According an industry group who opposes the bill, there are two provisions of this bill that are potentially problematic. First, the requirement to place a freeze within 15 minutes upon receiving a request does not allow the CCRAs enough time to conduct their verification and authentication processes in all cases. To ensure that a CCRA has time to verify that the right file is being frozen, the opposition group requests that the existing requirement to place the freeze within three business days remain in place. Second, the opposition group objects to the requirement that a CCRA transmit freeze requests to other CCRAs on the consumer's behalf, claiming that state laws regarding security freezes vary across states and complying with the proposed requirement in this bill may lead to problems for consumers.
Analysis Prepared by: Michael Burdick / B. & F. / (916) 319-3081 FN: 0002796
Date of Hearing: May 1, 2018
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Ed Chau, Chair
ABPCA Bill Id:AB 1742 (
Author:Quirk) – As Amended Ver:April 11, 2018
SUBJECT: Consumer credit reporting agencies: security freeze requests
SUMMARY: This bill would require a consumer credit reporting agency (CCRA) to place or lift a security freeze on a consumer’s credit report within 15 minutes upon receiving an electronic request from a consumer and would require the CCRA to offer to submit a security freeze request on behalf of a consumer to other CCRAs, as specified. Specifically, this bill would:
- Require a CCRA to place, temporarily lift, or remove a security freeze on a consumer’s credit file within 15 minutes of receiving a request electronically from the consumer, subject to receipt of proper identification.
- Require a CCRA to offer to submit a security freeze request on behalf of a consumer to all CCRAs that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, a CCRA would be required to submit the request to those consumer credit reporting agencies within 15 minutes of receiving a consumer’s acceptance electronically and within three days of receiving a consumer’s acceptance by mail.
- Require a CCRA that receives a request from another CCRA on behalf of a consumer to place, temporarily lift, or remove a security freeze to comply with the request within 15 minutes of receiving it.
EXISTING LAW:
- The federal Fair Credit Reporting Act requires that CCRAs adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information. (15 U.S.C. Sec. 1681(b).)
- The California Consumer Credit Reporting Agencies Act requires consumer credit reporting agencies to adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, hiring of a dwelling unit, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information. (Civ. Code Sec. 1785.1(d).)
- Allows a consumer to place a security alert in their credit report by making a request in writing or by telephone to a CCRA, and requires CCRAs to maintain a toll-free telephone number to accept security alert requests from consumers 24 hours a day, seven days a week, and to place the alert within five business days of receiving the request. “Security alert” is defined to mean a notice placed in a consumer’s credit report that notifies a recipient of the credit report that the consumer’s identity may have been used without the consumer’s consent to fraudulently obtain goods or services in the consumer’s name. (Civ. Code Sec. 1785.11.1.)
- Allows a consumer to place a security freeze on his or her credit report by making a request in writing by mail to a CCRA, and provides that if a security freeze is in place, information from a consumer’s credit report may not be released to a third party without prior express authorization from the consumer. “Security freeze” is defined to mean a notice placed in a consumer’s credit report that prohibits the CCRA from releasing the consumer’s credit report or any information from it without the express authorization of the consumer. (Civ. Code Sec. 1785.11.2(a).)
- Requires a CCRA to place a security freeze on a consumer’s credit report within three business days after receiving the consumer’s request. (Civ. Code Sec. 1785.11.2(b).)
- Requires a CCRA to send a written confirmation of a security freeze to the consumer within 10 business days, and to provide the consumer with a unique personal identification number or password to be used when he or she authorizes the release of his or her information for a specific party or period of time. (Civ. Code Sec. 1785.11.2(c)-(d).)
- Requires a CCRA that receives a consumer’s request to temporarily lift a freeze to comply with that request within three business days. (Civ. Code Sec. 1785.11.2(e).)
- Authorizes a consumer CCRA to develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report in an expedited manner. (Civ. Code Sec. 1785.11.2(f).)
- Provides that a CCRA may remove or temporarily lift a freeze only upon the consumer’s request or if the consumer’s credit report was frozen due to a material misrepresentation of fact by the consumer, in which case the credit reporting agency must notify the consumer before removing the freeze. (Civ. Code Sec. 1785.11.2(g).)
- Requires a security freeze to remain in place until the consumer requests that the security freeze be removed, and further requires a CCRA to remove a security freeze within three business days of receiving a request, as specified. (Civ. Code Sec. 1785.11.2(j).)
- Provides that CCRAs must require proper identification, as defined, of a consumer making a request to place or remove a security freeze. (Civ. Code Sec. 1785.11.2(k).)
- Requires, in the case of a CCRA that compiles and maintains consumer credit reports on a nationwide basis, that the CCRA provide a toll-free telephone number for consumers to use to communicate with the CCRA, and further requires written disclosures by a CCRA to any consumer to include a written summary of specified rights the consumer has and provides an example of a summary which is deemed in statute to be sufficient. (Civ. Code Sec. 1785.15(f).)
FISCAL EFFECT: None. This bill has been keyed nonfiscal by the Legislative Counsel.
COMMENTS:
- Purpose of this bill: This bill seeks to expedite and simplify the process by which a consumer can request a credit freeze by requiring CCRAs to initiate or lift a freeze within 15 minutes of receiving a request electronically, and requiring CCRAs to offer to communicate a consumer’s wish regarding a credit freeze to other CCRAs. This is an authored-sponsored bill.
- Author’s statement: According to the author, “Security breaches compromise personal data, and have become an all too common aspect of our modern, connected lifestyles. The most recent attack on Equifax, which compromised the private information of up to 143 million Americans is a perfect, but unfortunate, testament to the scale and pervasively of the risk. Proactive consumer action to prevent against fraud and theft is a necessity. A credit freeze is one of the simplest and most effective means for a consumer to protect themselves. Unfortunately, the process to freeze credit is time consuming and confusing. Worse, a consumer may be left with a dangerous false sense of security if they are unaware that to fully protect themselves they need to contact each credit agency individually to freeze all of their credit reports.
AB 1742 will correct the current confusing credit freeze process. Under AB 1742, when a consumer initiates a credit freeze, the contacted credit reporting agency must offer to initiate a likewise freeze at each of the other credit reporting agencies. The same rules will apply when a freeze is being lifted, either temporarily or permanently. AB 1742 makes straightforward changes to make it easier for Californians to protect themselves from security breaches we know are yet to come.” - Background: Identity theft victims’ information can be misused in numerous ways. One of the most common is the creation of new accounts, including credit card, utility, or wireless telephone accounts. An identity thief can use an individual’s information to fraudulently apply for credit, file taxes, or to get medical services. These acts can damage victims’ credit status, and cost them time and money as they attempt to restore their good name. Most victims do not discover that they are the victim of identity theft until months after the theft has occurred when they experience a financial consequence, such as a mystery bill, credit collection, or a denied loan application. (See Identity Theft < https://www.usa.gov/identity-theft> [as of April, 19, 2018].)
A credit report is a consumer’s credit history compiled by a credit reporting agency. The report contains information such as annual income, outstanding debt, bill-paying history, the number, types, and age of accounts, current and previous addresses, and Social Security number. Under federal law, a CCRA may disclose information contained in a credit report to current and prospective creditors, insurers, employers (provided the consumer has authorized the disclosure), and others who have a “legitimate business need” in connection with a business transaction initiated by the consumer. (15 U.S.C. Sec. 1681b.)
In 2001, California became the first state to give consumers the right to place a freeze on their credit reports, which prohibits a credit reporting agency from releasing the consumer’s credit report without the express authorization of the consumer. (See SB 168 (Bowen, Ch. 720, Stats. 2001).) Last year, Equifax suffered a cybersecurity breach caused by a website vulnerability that occurred from mid-May through July 2017. The breach gave criminals access to information including consumer names, Social Security numbers, birth dates, addresses, and in some instances, driver’s license numbers. Credit card numbers were accessed for approximately 209,000 U.S. consumers, as were documents with personal identifying information for approximately 182,000 US consumers. The breach also permitted unauthorized access to personal information for some United Kingdom and Canadian residents. On October 2, 2017, the cybersecurity firm Mandiant completed the forensic portion of the investigation into the breach and determined that 145.5 million U.S. consumers were potentially impacted by the breach. (McCoy, USA Today, Do you want to sue Equifax over the cyberbreach? Winning a lawsuit may not be so easy (Sept. 2017) <https://www. usatoday.com/story/money/2017 /09/22/do-you-want-sue-equifax-over-cyberbreach-winning-lawsuit-may-not-so-easy/684455001/> [as of April 5, 2018].)
The Equifax breach, which affected nearly 50 percent of the total U.S. population of 323 million people, was not an isolated or limited incident. According to news reports, this breach is only the fifth largest data breach impacting U.S. consumers. (Wise, USA Today Equifax breach: Is it the biggest data breach? (Sept. 2017) < https://www.usatoday.com /story/tech/ 2017/09/07/nations-biggest-hacks-and-data-breaches-millions/644311001/>[as of April 5, 2018].) In fact, according to an Identity Theft Resource Center Data Breach Summary, there have been 273 data breaches recorded this year through April 1, and that nearly 5.5 million records have been exposed since the beginning of the year. In response to the Equifax breach, consumer protection advocates and state regulators, including the California Department of Business Oversight and the California Attorney General, recommended that consumers consider placing a security freeze on their credit files.
- Placing and lifting security freezes within 15 minutes: This bill would permit a consumer to request a security freeze, a temporary lift of a security freeze, or the removal of a security freeze electronically, and would require a CCRA that receives such an electronic request to comply with the request within 15 minutes. The Consumer Data Industry Association (CDIA), while supportive of certain aspects of the bill, such as the requiring CCRAs to accept freeze requests electronically, nonetheless opposes the bill for other reasons. In opposition, CDIA writes, “[w]hen a consumer comes to a CCRA with a request to freeze a credit report, CCRAs must vet that consumer and the authenticity of the request. This verification and authentication can take some time, which is why the statute allows for an outside limit of three business days. Placing a freeze may often take less than three business days, [and] CCRAs need that flexibility to make sure the freeze is done correctly. The strict liability that comes with a violation for missing a deadline or placing the freeze incorrectly is too much to bear and does not offer much consumer benefit.” Indeed, existing law requires that CCRAs require proper identification of the person making a request to place or remove a security freeze, and gives CCRAs the authority to require additional information concerning the consumer’s employment and personal or family history in order to verify his or her identity. (Civ. Code Secs. 1785.11.2(k) and 1785.15(c).)
This vetting arguably takes longer for the placing of a security freeze than for the lifting of one, because CCRAs are required to give consumers a unique password to use when removing a security freeze. Thus, the identity of a consumer lifting a security freeze is verified quickly and easily because of the unique password. Consumers wishing to initiate a freeze, however, do not have the benefit of this unique identifier, which can result in the verification process taking more time. An unintended consequence of the 15 minute time limit for the placing of security freezes under this bill may be that CCRAs are not able to property identify consumers who are making security freeze requests, which could arguably result in fraud as well.
Given that the author’s intent is to expedite the process of placing a security freeze in order to help protect consumers from identity theft, the author agrees to amend the bill to ensure that CCRAs are able to properly vet requests as required by existing law. Specifically, the author has agreed to the following amendments which would require that CCRAs place a security freeze within 15 minutes of authenticating a consumer and request, but in no event more than 24 hours after an electronic request was received. This arguably strikes the appropriate balance in ensuring that security freezes are issued in a timely manner, while still allowing adequate time for proper vetting of a request as required by existing law.
Author’s amendments:
On page 3, line 25, strike “receiving” and insert “authenticating”
On page 3, line 25, after “request” insert “that was received”
On page 3, line 25, after “consumer” insert “and in no event later than 24 hours after receiving a request electronically from a consumer,”
- Submitting security freeze requests to other CCRAs on behalf of consumers: The bill would also require a CCRA that receives a security freeze request, a request for temporary lift of a freeze, or a request for removal of a freeze to offer to submit that request on the consumer’s behalf to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis. The bill would require a CCRA, if the consumer accepts the offer, to submit the request to the consumer credit reporting agencies within specified periods of time. In opposition, CDIA argues that the sharing of freeze requests among CCRAs is complicated and unnecessary. CDIA writes:
Consumer reporting agencies operating on a nationwide basis, as defined by the federal Fair Credit Reporting Act (FCRA), 15 U.S.C. Sec. 1681a(p) share fraud alerts because the fraud alert is a national standard set by Congress that applies evenly across state lines. Unlike fraud alerts, credit freezes vary from one state to another and the application of freeze laws across states is uneven and growing more so with each state legislative season. Asking the CCRAs to share freeze requests across state lines when the laws vary as they do may lead to consumer problems. Consumers who move, and some 15 [percent] of all consumers move each year, can experience an uneven experience that may cause delays in getting their freezes placed in a timely fashion. Alternatively, the strict liability standards that come with the CCRA force liability even when CCRAs are trying to do the right thing to service consumers. CDIA welcomes the day that there is a national credit freeze system and an ability to provide an even experience across state lines, but, for now, California should not jeopardize consumers by forcing a national sharing of requests for a state law.
Countering those arguments, the Consumers Union writes in support, “this bill would enable consumers to place a security freeze at each of the major credit bureaus with just a single request to one bureau—greatly simplifying the process and facilitating access to freezes. California joins several states, including Massachusetts, that have introduced “one call” provisions this year to help ease the process for setting up freezes at the major bureaus. Under federal law, credit bureaus are already required to forward requests for fraud alerts to the other major bureaus. This measure would simply extend this feature to security freezes, enabling consumers to more easily set up this effective tool to prevent identity theft.”
- Related legislation: SB 823 (Hill) would prohibit fees for placing, temporarily lifting, replacing, or removing security freezes on credit reports; require prominent links be provided by the agencies for quick, electronic control over these actions; shorten the time line for these actions; and require agencies to ensure these actions are also taken with other agencies when the consumer so elects. This bill is currently on the Senate Floor.
- Prior legislation: AB 2374 (Hernández, Ch. 645, Stats. 2012) prohibited credit reporting agencies from charging specified consumers any fee for the initial placement of a security freeze, but authorized such agencies to charge a fee of up to $5 for lifting, removing, or replacing a security freeze.
AB 372 (Salas, Ch. 151, Stats. 2008) permitted a credit reporting agency to charge a fee of no more than $5 to a consumer 65 years of age or older and no more than $10 to other consumers for a request for a security freeze, removal of the freeze, or temporary lifting of the freeze for a period of time or for a specific party.
AB 2043 (Banking and Finance Committee, Ch. 521, Stats. 2006) authorized specified business entities that become the victims of identity theft to utilize debt relief protections available to natural persons who are victimized by identity theft.
AB 1294 (Wiggins, Ch. 287, Stats. 2003) required a debt collector to stop collecting a consumer’s debt if an alleged debtor provides the collector with specified information showing that the debtor is a victim of identity theft, as specified.
SB 168 (Bowen, Ch. 720, Stats. 2001) gave California consumers the right to place a freeze on their credit reports, which, while in place, prohibits a credit reporting agency from releasing the consumer’s credit report without the express authorization of the consumer.
AB 156 (Murray, Ch. 768, Stats. 1997) formally recognized identity theft as a crime, providing that it is a misdemeanor for a person to willfully obtain personal identifying information of another and use that information to obtain, or attempt to obtain, credit, goods, or services in the name of another person without the consent of that person.
- Double-referral: This bill was double-referred to the Assembly Banking and Finance Committee where it was heard on April 16, 2018, and passed out on a 8-1 vote.
REGISTERED SUPPORT / OPPOSITION:
Support
California District Attorneys Association
California Senior Legislature
Consumers Union
Opposition
Consumer Data Industry Association
Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200
Date of Hearing: April 16, 2018
ASSEMBLY COMMITTEE ON BANKING AND FINANCE
Monique Limón, Chair
ABPCA Bill Id:AB 1742 (
Author:Quirk) – As Amended Ver:April 11, 2018
SUBJECT: Consumer credit reporting agencies: security freeze requests
SUMMARY: Requires a consumer credit reporting agency (CCRA) (i) to place or lift a security freeze on a consumer’s credit report no later than 15 minutes upon receiving a request electronically from a consumer and (ii) to offer to submit a security freeze request on behalf of a consumer to all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis.
Specifically, this bill:
- Requires a CCRA to place, temporarily lift, or remove a security freeze on a consumer’s credit file within 15 minutes of receiving a request electronically from the consumer, subject to receipt of proper identification.
- Requires a CCRA to offer to submit a security freeze request on behalf of a consumer to all CCRAs that compile and maintain files on consumers on a nationwide basis. If the consumer accepts, a CCRA is required to submit the request to those consumer credit reporting agencies within 15 minutes of receiving a consumer’s acceptance electronically and within three days of receiving a consumer’s acceptance by mail.
- Requires a CCRA that receives a request from another CCRA on behalf of a consumer to place, temporarily lift, or remove a security freeze to comply with the request within 15 minutes of receiving it.
EXISTING LAW:
- Regulates CCRAs via the Consumer Credit Reporting Agencies Act. [Civil Code, Section 1785.1 et seq.]
- Permits a consumer to place, temporarily lift, or remove a security freeze on his or her credit report by making a request in writing by mail to a CCRA. Defines “security freeze” as a notice placed in a consumer’s credit report that prohibits the consumer credit reporting agency from releasing the consumer’s credit report or any information from it without the express authorization of the consumer, subject to certain exceptions. If a security freeze is in place, information from a consumer’s credit report may not be released to a third party without prior express authorization from the consumer. [Section 1785.11.2]
- Permits a CCRA to develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a security freeze on a credit report. [Section 1785.11.2]
- Requires a CCRA to comply with a consumer’s request to place, temporarily lift, or remove a security freeze within three days, subject to receipt of proper identification. [Section 1785.11.2]
FISCAL EFFECT: Unknown
COMMENTS:
- PURPOSE
The author states:
“Security breaches compromise personal data, and have become an all too common aspect of our modern, connected lifestyles. The most recent attack on Equifax, which compromised the private information of up to 143 million American is a perfect but unfortunate testament to the scale and pervasiveness of the risk. Proactive consumer action to prevent against fraud and theft is a necessity. A credit freeze is one of the simplest and most effective means for a consumer to protect themselves. Unfortunately, the process to freeze credit is time consuming and confusing. Worse, a consumer may be left with a dangerous false sense of security if they are unaware that to fully protect themselves they need to contact each credit agency individually to freeze all of their credit reports.
AB 1742 will correct the current confusing credit freeze process. Under AB 1742, when a consumer initiates a credit freeze, the contacted credit reporting agency must offer to initiate a likewise freeze at each of the other credit reporting agencies. The same rules will apply when a freeze is being lifted, either temporarily or permanently. AB 1742 makes straightforward changes to make it easier for Californians to protect themselves from security breaches we know are yet to come.”
- BACKGROUND
On September 7, 2017, Equifax publically disclosed a cybersecurity breach of the company that resulted in the loss of 147.9 million US consumers’ personal information. Equifax is one of the big three consumer credit reporting agencies (CCRAs), along with Experian and TransUnion. CCRAs assemble consumer financial information for the purpose of issuing credit reports to third parties. The credit reports contain a historical record of the debts and associated payment information of individuals. The information in a credit file is used to generate a credit score which serves as a quantitative metric of an individual’s credit risk, or the likelihood that the individual will pay back a loan. These reports are provided for particular purposes. The most common use of credit reports is to help lenders assess the risk of potential borrowers when underwriting a loan. Credit reports are also used by landlords when evaluating potential tenants and by employers when evaluating potential employees.
According to Equifax, a cybersecurity breach caused by a website vulnerability occurred from mid-May through July 2017.[1] The breach gave criminals access to consumer names, Social Security numbers, birth dates, addresses, and in some instances, driver’s license numbers. Credit card numbers were accessed for approximately 209,000 United States (US) consumers, as were documents with personal identifying information for approximately 182,000 US consumers.
In response to the Equifax breach, consumer protection advocates and state regulators, including the California Department of Business Oversight and the California Attorney General, recommended that consumers consider placing a security freeze on their credit files. A security freeze is among the strongest actions that a consumer can take to protect himself or herself from the risk of a fraudulent credit account being issued using the consumer’s stolen information. Prior to opening a new credit line, a consumer must provide proper identification, including a unique personal identification number or password provided by the CCRA, with a request to the CCRA to temporarily lift or remove the security freeze. Under existing law, CCRAs can charge up to $10 to place, temporarily lift, or remove a credit freeze, as specified in subdivision (m) of Section 1785.11.2 of the Civil Code. SB 823 of the current legislative session would prohibit CCRAs from charging any fees for these services.
A security freeze is not the only option that consumers have to protect themselves from the risk of fraud. A consumer may place a security alert on his or her credit report, which requires a CCRA to notify a consumer when the consumer’s identity may have been used without the consumer’s consent. A CCRA is also required to notify each person that requests consumer credit information in connection with the application for an extension of credit that a security alert is in place, and the person processing the credit application is required to take reasonable steps to verify the consumer’s identity. Consumers do not have to pay for a security alert. Security alerts remain in place for at least 90 days and must be renewed by the consumer upon expiry. If the security alert lapses or a consumer’s identity is sufficiently compromised, the risk of a fraudulent credit line being opened in a consumer’s name is higher with a security alert than with a security freeze. A risk-averse consumer may prefer the additional security provided by a security freeze.
CCRAs and other companies offer products and services related to identity theft protection and credit monitoring. These services typically cost from $10 to $30 per month. Many consumers may prefer the less expensive option of placing a security freeze on their credit report, especially if the process for placing a security freeze was more convenient and free (as proposed by this bill and SB 823, respectively).
- INDUSTRY CONCERNS MAY BE OVERBLOWN
The Consumer Data Industry Association (CDIA), an international trade association whose members include CCRAs, expressed concern about two provisions of this bill. First, CDIA states that it is risky to require placement of a freeze within 15 minutes if the request is made electronically. According to CDIA, the verification and authentication process of electronic requests can take longer than 15 minutes. To ensure that a CCRA has time to verify that the right file is being frozen, CDIA requests that the existing requirement to place the freeze within three business days remain in place. Without more detail about the specific verification processes conducted by CCRAs, it is difficult to evaluate the industry’s concerns. Changing the three day requirement in existing law to the proposed 15 minute requirement is unlikely to materially reduce the risk of financial fraud for consumers, and the author may consider amending the bill if the industry provides more information regarding their concern.
Second, the CDIA objects to the requirement that a CCRA transmit freeze requests to other CCRAs on the consumer’s behalf. CDIA claims that state laws regarding security freezes vary across states and complying with the proposed requirement in this bill may lead to problems for consumers. Given that this bill would apply to California residents only, it is not clear how complying with the requirement to share a freeze request from a California consumer with other CCRAs would run afoul of laws in other states. Additionally, CCRAs are already required by federal law to forward requests for security alerts to other major CCRAs, and the CCRAs can establish a similar process for sharing freeze requests.
In addition to the speciousness of the argument about varying laws in different states, CDIA’s argument concludes that “there are some things that consumers must do for themselves if they have been or suspect they have been a victim of crime.” CDIA’s attempt to push the responsibility of protecting confidential data back to the consumer may be ill-conceived given that the Equifax data breach is the primary cause for exposing over 147 million Americans to a heightened risk of identity theft in the first place.
- CONSUMER BENEFITS
The Equifax data breach led to widespread concern among consumers with many wanting to know their options for protecting themselves from identity theft and credit fraud. Consumer advocates and government regulators generally agree that placing a security freeze on one’s credit report is among the strongest protections available to consumers. This bill would increase the convenience of placing, lifting, and removing a security freeze, likely leading to higher adoption of security freezes and lowering the overall risk of fraudulent credit lines being opened by criminals. Not only does this benefit the consumer, but it also reduces fraud-related costs borne by creditors.
REGISTERED SUPPORT / OPPOSITION:
Support
California District Attorneys Association
California Senior Legislature
Consumers Union
Opposition
Consumer Data Industry Association
Analysis Prepared by: Michael Burdick / B. & F. / (916) 319-3081
Cybersecurity Incident & Important Consumer Information. September 7, 2017.
https://www.equifaxsecurity2017.com/2017/09/07/equifax-announces-cybersecurity-incident-involving-consumer-information/ ↑
Discussed in Hearing
1MIN
Assembly Floor
11MIN
Assembly Standing Committee on Privacy and Consumer Protection
13MIN
Assembly Standing Committee on Banking and Finance
Bill Author
Bill Co-Author(s):