AB 608: Medical assistants.
- Session Year: 2017-2018
- House: Assembly
- Latest Version Date: 2018-08-09
Existing law, the Medical Practice Act, provides for the licensure and regulation of the practice of medicine by the Medical Board of California. The act authorizes a medical assistant to administer medication only by intradermal, subcutaneous, or intramuscular injections and to perform skin tests and additional technical supportive services upon the specific authorization and supervision of a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife. Existing law defines the term technical supportive services to mean simple routine medical tasks and procedures that may be safely performed by a medical assistant who has limited training and who functions under the supervision of a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife.
This bill would define technical supportive services to also include drawing up a local aesthetic anesthetic provided specified conditions are met.
This bill would declare that it is to take effect immediately as an urgency statute.
Existing law, the Medical Practice Act, provides for the licensure and regulation of the practice of medicine by the Medical Board of California. The act authorizes a medical assistant to administer medication only by intradermal, subcutaneous, or intramuscular injections and to perform skin tests and additional technical supportive services upon the specific authorization and supervision of a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife. Existing law defines the term technical supportive services to mean simple routine medical tasks and procedures that may be safely performed by a medical assistant who has limited training and who functions under the supervision of a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife.
This bill would define technical supportive services to also include drawing up a local aesthetic provided specified conditions are met.
This bill would declare that it is to take effect immediately as an urgency statute.
The Consumer Credit Reporting Agencies Act permits a consumer to place a security freeze on his or her credit report to prohibit the release of the consumers credit reporting information, subject to certain exceptions, by making a request in writing by mail to a consumer credit reporting agency.The act also requires a consumer credit reporting agency, in certain circumstances, to place a security freeze on behalf of a protected consumer, defined to include an individual under 16 years of age at the time a request for the placement of a security freeze is made, an incapacitated person, an individual for whom a guardian or conservator has been appointed, or a person in foster care under county jurisdiction who meets certain conditions. With respect to placing a security freeze for a protected consumer, a consumer credit reporting agency is required to do so if it receives a request from the protected consumers representative, along with certain identifying information and proof of authority to act on behalf of the protected consumer, and if that representative pays to the consumer credit reporting agency a fee, not to exceed $10 for each placement or removal of a security freeze, subject to specified exceptions.This bill would prohibit a consumer credit reporting agency from charging fees for these services. This bill would declare that it is to take effect immediately as an urgency statute.The Consumer Credit Reporting Agencies Act permits a consumer to place a security freeze on his or her credit report to prohibit the release of the consumers credit reporting information, subject to certain exceptions, by making a request in writing by mail to a consumer credit reporting agency.
The act also requires a consumer credit reporting agency, in certain circumstances, to place a security freeze on behalf of a protected consumer, defined to include an individual under 16 years of age at the time a request for the placement of a security freeze is made, an incapacitated person, an individual for whom a guardian or conservator has been appointed, or a person in foster care under county jurisdiction who meets certain conditions. With respect to placing a security freeze for a protected consumer, a consumer credit reporting agency is required to do so if it receives a request from the protected consumers representative, along with certain identifying information and proof of authority to act on behalf of the protected consumer, and if that representative pays to the consumer credit reporting agency a fee, not to exceed $10 for each placement or removal of a security freeze, subject to specified exceptions.
This bill would prohibit a consumer credit reporting agency from charging fees for these services.
This bill would declare that it is to take effect immediately as an urgency statute.
The Consumer Credit Reporting Agencies Act permits a consumer to place a security freeze on his or her credit report to prohibit the release of the consumers credit reporting information, subject to certain exceptions, by making a request in writing by mail to a consumer credit reporting agency.
The act also requires a consumer credit reporting agency, in certain circumstances, to place a security freeze on behalf of a protected consumer, defined to include an individual under 16 years of age at the time a request for the placement of a security freeze is made, an incapacitated person, an individual for whom a guardian or conservator has been appointed, or a person in foster care under county jurisdiction who meets certain conditions. With respect to placing a security freeze for a protected consumer, a consumer credit reporting agency is required to do so if it receives a request from the protected consumers representative, along with certain identifying information and proof of authority to act on behalf of the protected consumer, and if that representative pays to the consumer credit reporting agency a fee, not to exceed $10 for each placement or removal of a security freeze, subject to specified exceptions.
This bill would prohibit a consumer credit reporting agency from charging fees for these services.
Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions.Existing law requires a warrant issued pursuant to the act to require that any information obtained through the execution of the warrant, that is unrelated to the objective of the warrant, be sealed and not be subject to further review, use, or disclosure. Existing law also provides that the warrant may require that the information be destroyed as soon as feasible after the termination of the investigation and any related investigations or proceedings.This bill would specify the manner in which unrelated information obtained pursuant to a warrant is to be sealed, and by whom. The bill would also clarify that the information may be retained, before being destroyed, through the conclusion of any proceeding, including appellate proceedings.Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions.
Existing law requires a warrant issued pursuant to the act to require that any information obtained through the execution of the warrant, that is unrelated to the objective of the warrant, be sealed and not be subject to further review, use, or disclosure. Existing law also provides that the warrant may require that the information be destroyed as soon as feasible after the termination of the investigation and any related investigations or proceedings.
This bill would specify the manner in which unrelated information obtained pursuant to a warrant is to be sealed. This bill would specify that information obtained pursuant to these provisions may, as specified in the warrant, be returned to the person from which it was obtained instead of being destroyed. This sealed, and by whom. The bill would also clarify that the information may be retained, before being destroyed or returned, destroyed, through the conclusion of any proceeding, including appellate proceedings.
Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions.
Existing law requires a warrant issued pursuant to this the act to require that any information obtained through the execution of the warrant, that is unrelated to the objective of the warrant, be sealed and not be subject to further review, use, or disclosure. Existing law also provides that the warrant may require that the information be destroyed as soon as feasible after the termination of the investigation and any related investigations or proceedings.
This bill would specify the manner in which unrelated information obtained pursuant to a warrant is to be sealed. This bill would specify that information obtained pursuant to these provisions may, as specified in the warrant, be returned to the person from which it was obtained instead of being destroyed. This bill would also clarify that the information may be retained, before being destroyed or returned, through the conclusion of any proceeding, including appellate proceedings.
Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions.
Existing law requires a warrant issued pursuant to this act to require that any information obtained through the execution of the warrant, that is unrelated to the objective of the warrant, be sealed and not be subject to further review, use, or disclosure. Existing law also provides that the warrant may require that the information be destroyed as soon as feasible after the termination of the investigation and any related investigations or proceedings.
This bill would specify the manner in which unrelated information obtained pursuant to a warrant is to be sealed. This bill would specify that information obtained pursuant to these provisions may, as specified in the warrant, be returned to the person from which it was obtained instead of being destroyed. This bill would also clarify that the information may be retained, before being destroyed or returned, through the conclusion of any proceeding, including appellate proceedings.
(a)(1)Notwithstanding any other law, a medical assistant may administer medication only by intradermal, subcutaneous, or intramuscular injections and perform skin tests and additional technical supportive services upon the specific authorization and supervision of a licensed physician and surgeon or a licensed podiatrist. A medical assistant may also perform all these tasks and services upon the specific authorization of a physician assistant, a nurse practitioner, or a certified nurse-midwife.
(2)The supervising physician and surgeon may, at his or her discretion, in consultation with the nurse practitioner, certified nurse-midwife, or physician assistant, provide written instructions to be followed by a medical assistant in the performance of tasks or supportive services. These written instructions may provide that the supervisory function for the medical assistant for these tasks or supportive services may be delegated to the nurse practitioner, certified nurse-midwife, or physician assistant within the standardized procedures or protocol, and that tasks may be performed when the supervising physician and surgeon is not onsite, if either of the following apply:
(A)The nurse practitioner or certified nurse-midwife is functioning pursuant to standardized procedures, as defined by Section 2725, or protocol. The standardized procedures or protocol, including instructions for specific authorizations, shall be developed and approved by the supervising physician and surgeon and the nurse practitioner or certified nurse-midwife.
(B)The physician assistant is functioning pursuant to regulated services defined in Section 3502, including instructions for specific authorizations, and is approved to do so by the supervising physician and surgeon.
(b)As used in this section and Sections 2070 and 2071, the following definitions apply:
(1)Medical assistant means a person who may be unlicensed, who performs basic administrative, clerical, and technical supportive services in compliance with this section and Section 2070 for a licensed physician and surgeon or a licensed podiatrist, or group thereof, for a medical or podiatry corporation, for a physician assistant, a nurse practitioner, or a certified nurse-midwife as provided in subdivision (a), or for a health care service plan, who is at least 18 years of age, and who has had at least the minimum amount of hours of appropriate training pursuant to standards established by the board. The medical assistant shall be issued a certificate by the training institution or instructor indicating satisfactory completion of the required training. A copy of the certificate shall be retained as a record by each employer of the medical assistant.
(2)Specific authorization means a specific written order prepared by the supervising physician and surgeon or the supervising podiatrist, or the physician assistant, the nurse practitioner, or the certified nurse-midwife as provided in subdivision (a), authorizing the procedures to be performed on a patient, which shall be placed in the patients medical record, or a standing order prepared by the supervising physician and surgeon or the supervising podiatrist, or the physician assistant, the nurse practitioner, or the certified nurse-midwife as provided in subdivision (a), authorizing the procedures to be performed, the duration of which shall be consistent with accepted medical practice. A notation of the standing order shall be placed on the patients medical record.
(3)Supervision means the supervision of procedures authorized by this section by the following practitioners, within the scope of their respective practices, who shall be physically present in the treatment facility during the performance of those procedures:
(A)A licensed physician and surgeon.
(B)A licensed podiatrist.
(C)A physician assistant, nurse practitioner, or certified nurse-midwife as provided in subdivision (a).
(4)(A)Technical supportive services means simple routine medical tasks and procedures that may be safely performed by a medical assistant who has limited training and who functions under the supervision of a licensed physician and surgeon or a licensed podiatrist, or a physician assistant, a nurse practitioner, or a certified nurse-midwife as provided in subdivision (a).
(B)Notwithstanding any other law, in a facility licensed by the California State Board of Pharmacy under Section 4180 or 4190, other than a facility operated by the state, technical supportive services also includes handing to a patient a prepackaged prescription drug, excluding a controlled substance, that is labeled in compliance with Section 4170 and all other applicable state and federal laws and ordered by a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife in accordance with subdivision (a). In every instance, prior to handing the medication to a patient pursuant to this subparagraph, the properly labeled and prepackaged prescription drug shall have the patients name affixed to the package and a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife shall verify that it is the correct medication and dosage for that specific patient and shall provide the appropriate patient consultation regarding use of the drug.
(C)Notwithstanding any other law, technical supportive services also includes drawing up a local anesthetic, such as lidocaine in a syringe, provided all of the following conditions are met:
(i)A supervising licensed physician and surgeon, licensed podiatrist, licensed physician assistant, licensed nurse practitioner, or certified nurse-midwife is present while physically observes the medical assistant is drawing draw up the anesthetic.
(ii)A supervising licensed physician and surgeon, licensed podiatrist, licensed physician assistant, licensed nurse practitioner, or certified nurse-midwife verifies that each syringe label is accurate.
(iii)The anesthetic is a local anesthetic and is reconstituted by someone with a license to do so or comes reconstituted from the manufacturer.
(c)Nothing in this section shall be construed as authorizing any of the following:
(1)The licensure of medical assistants.
(2)The administration of local anesthetic agents by a medical assistant.
(3)The board to adopt any regulations that violate the prohibitions on diagnosis or treatment in Section 2052.
(4)A medical assistant to perform any clinical laboratory test or examination for which he or she is not authorized by Chapter 3 (commencing with Section 1200).
(5)A nurse practitioner, certified nurse-midwife, or physician assistant to be a laboratory director of a clinical laboratory, as those terms are defined in paragraph (8) of subdivision (a) of Section 1206 and subdivision (a) of Section 1209.
(d)A nurse practitioner, certified nurse-midwife, or physician assistant shall not authorize a medical assistant to perform any clinical laboratory test or examination for which the medical assistant is not authorized by Chapter 3 (commencing with Section 1200). A violation of this subdivision constitutes unprofessional conduct.
(e)Notwithstanding any other law, a medical assistant shall not be employed for inpatient care in a licensed general acute care hospital, as defined in subdivision (a) of Section 1250 of the Health and Safety Code.
SEC. 2.This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the California Constitution and shall go into immediate effect. The facts constituting the necessity are:
In order to assist physicians and surgeons with the treatment of their patients by utilizing medical assistants to draw up a local anesthetic under certain circumstances to protect the public health and safety, it is necessary that this act take effect immediately.
(a)(1)Notwithstanding any other law, a medical assistant may administer medication only by intradermal, subcutaneous, or intramuscular injections and perform skin tests and additional technical supportive services upon the specific authorization and supervision of a licensed physician and surgeon or a licensed podiatrist. A medical assistant may also perform all these tasks and services upon the specific authorization of a physician assistant, a nurse practitioner, or a certified nurse-midwife.
(2)The supervising physician and surgeon may, at his or her discretion, in consultation with the nurse practitioner, certified nurse-midwife, or physician assistant, provide written instructions to be followed by a medical assistant in the performance of tasks or supportive services. These written instructions may provide that the supervisory function for the medical assistant for these tasks or supportive services may be delegated to the nurse practitioner, certified nurse-midwife, or physician assistant within the standardized procedures or protocol, and that tasks may be performed when the supervising physician and surgeon is not onsite, if either of the following apply:
(A)The nurse practitioner or certified nurse-midwife is functioning pursuant to standardized procedures, as defined by Section 2725, or protocol. The standardized procedures or protocol, including instructions for specific authorizations, shall be developed and approved by the supervising physician and surgeon and the nurse practitioner or certified nurse-midwife.
(B)The physician assistant is functioning pursuant to regulated services defined in Section 3502, including instructions for specific authorizations, and is approved to do so by the supervising physician and surgeon.
(b)As used in this section and Sections 2070 and 2071, the following definitions apply:
(1)Medical assistant means a person who may be unlicensed, who performs basic administrative, clerical, and technical supportive services in compliance with this section and Section 2070 for a licensed physician and surgeon or a licensed podiatrist, or group thereof, for a medical or podiatry corporation, for a physician assistant, a nurse practitioner, or a certified nurse-midwife as provided in subdivision (a), or for a health care service plan, who is at least 18 years of age, and who has had at least the minimum amount of hours of appropriate training pursuant to standards established by the board. The medical assistant shall be issued a certificate by the training institution or instructor indicating satisfactory completion of the required training. A copy of the certificate shall be retained as a record by each employer of the medical assistant.
(2)Specific authorization means a specific written order prepared by the supervising physician and surgeon or the supervising podiatrist, or the physician assistant, the nurse practitioner, or the certified nurse-midwife as provided in subdivision (a), authorizing the procedures to be performed on a patient, which shall be placed in the patients medical record, or a standing order prepared by the supervising physician and surgeon or the supervising podiatrist, or the physician assistant, the nurse practitioner, or the certified nurse-midwife as provided in subdivision (a), authorizing the procedures to be performed, the duration of which shall be consistent with accepted medical practice. A notation of the standing order shall be placed on the patients medical record.
(3)Supervision means the supervision of procedures authorized by this section by the following practitioners, within the scope of their respective practices, who shall be physically present in the treatment facility during the performance of those procedures:
(A)A licensed physician and surgeon.
(B)A licensed podiatrist.
(C)A physician assistant, nurse practitioner, or certified nurse-midwife as provided in subdivision (a).
(4)(A)Technical supportive services means simple routine medical tasks and procedures that may be safely performed by a medical assistant who has limited training and who functions under the supervision of a licensed physician and surgeon or a licensed podiatrist, or a physician assistant, a nurse practitioner, or a certified nurse-midwife as provided in subdivision (a).
(B)Notwithstanding any other law, in a facility licensed by the California State Board of Pharmacy under Section 4180 or 4190, other than a facility operated by the state, technical supportive services also includes handing to a patient a prepackaged prescription drug, excluding a controlled substance, that is labeled in compliance with Section 4170 and all other applicable state and federal laws and ordered by a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife in accordance with subdivision (a). In every instance, prior to handing the medication to a patient pursuant to this subparagraph, the properly labeled and prepackaged prescription drug shall have the patients name affixed to the package and a licensed physician and surgeon, a licensed podiatrist, a physician assistant, a nurse practitioner, or a certified nurse-midwife shall verify that it is the correct medication and dosage for that specific patient and shall provide the appropriate patient consultation regarding use of the drug.
(C)Notwithstanding any other law, technical supportive services also includes drawing up a local anesthetic, such as lidocaine in a syringe, provided all of the following conditions are met:
(i)A supervising licensed physician and surgeon, licensed podiatrist, licensed physician assistant, licensed nurse practitioner, or certified nurse-midwife is present while the medical assistant is drawing up the anesthetic.
(ii)A supervising licensed physician and surgeon, licensed podiatrist, licensed physician assistant, licensed nurse practitioner, or certified nurse-midwife verifies that each syringe label is accurate.
(iii)The anesthetic is a local anesthetic and is reconstituted by someone with a license to do so or comes reconstituted from the manufacturer.
(c)Nothing in this section shall be construed as authorizing any of the following:
(1)The licensure of medical assistants.
(2)The administration of local anesthetic agents by a medical assistant.
(3)The board to adopt any regulations that violate the prohibitions on diagnosis or treatment in Section 2052.
(4)A medical assistant to perform any clinical laboratory test or examination for which he or she is not authorized by Chapter 3 (commencing with Section 1200).
(5)A nurse practitioner, certified nurse-midwife, or physician assistant to be a laboratory director of a clinical laboratory, as those terms are defined in paragraph (8) of subdivision (a) of Section 1206 and subdivision (a) of Section 1209.
(d)A nurse practitioner, certified nurse-midwife, or physician assistant shall not authorize a medical assistant to perform any clinical laboratory test or examination for which the medical assistant is not authorized by Chapter 3 (commencing with Section 1200). A violation of this subdivision constitutes unprofessional conduct.
(e)Notwithstanding any other law, a medical assistant shall not be employed for inpatient care in a licensed general acute care hospital, as defined in subdivision (a) of Section 1250 of the Health and Safety Code.
SEC. 2.This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the California Constitution and shall go into immediate effect. The facts constituting the necessity are:
In order to assist physicians and surgeons with the treatment of their patients by utilizing medical assistants to draw up a local anesthetic under certain circumstances to protect the public health and safety, it is necessary that this act take effect immediately.
SECTION 1.Section 1785.11.11 of the Civil Code is amended to read:1785.11.11.(a)A consumer credit reporting agency shall place a security freeze for a protected consumer if both of the following occur:(1)The consumer credit reporting agency receives a request from the protected consumers representative for the placement of the security freeze pursuant to this section.(2)The protected consumers representative does all of the following:(A)Submits the request to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.(B)Provides to the consumer credit reporting agency sufficient proof of identification of the protected consumer and the representative.(C)Provides to the consumer credit reporting agency sufficient proof of authority to act on behalf of the protected consumer.(b)If a consumer credit reporting agency does not have a file pertaining to a protected consumer when the consumer credit reporting agency receives a request pursuant to paragraph (1) of subdivision (a), the consumer credit reporting agency shall create a record for the protected consumer.(c)If a protected consumers representative requests a security freeze, the consumer credit reporting agency shall disclose the process for placing and removing a security freeze.(d)Within 30 days after receiving a request that meets the requirements of subdivision (a), a consumer credit reporting agency shall place a security freeze for the protected consumer. The consumer credit reporting agency shall send written confirmation of the security freeze to the address on file within 10 days of the placement of the security freeze.(e)Unless a security freeze for a protected consumer is removed pursuant to subdivision (h) or (j), a consumer credit reporting agency shall not release the protected consumers consumer credit report, any information derived from the protected consumers consumer credit report, or any record created for the protected consumer.(f)A security freeze for a protected consumer placed pursuant to this section shall remain in effect until either of the following occurs:(1)The protected consumer or the protected consumers representative requests that the consumer credit reporting agency remove the security freeze in accordance with subdivision (h).(2)The security freeze is removed in accordance with subdivision (j).(g)To remove a security freeze, a protected consumer or a protected consumers representative shall do both of the following:(1)Submit a request for removal of the security freeze to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.(2)Provide to the consumer credit reporting agency:(A)If the request is made by the protected consumer:(i)Proof that the sufficient proof of authority for the protected consumers representative to act on behalf of the protected consumer is no longer valid, he or she has been emancipated, or he or she is 16 years of age or older.(ii)Sufficient proof of identification of the protected consumer.(B)If the request is made by the representative of a protected consumer:(i)Sufficient proof of identification of the protected consumer and the representative.(ii)Sufficient proof of authority to act on behalf of the protected consumer.(h)Within 30 days after receiving a request that meets the requirements of subdivision (g), a consumer credit reporting agency shall remove a security freeze for a protected consumer.(i)A consumer credit reporting agency may not charge a fee for any service performed pursuant to this section.(j)A consumer credit reporting agency is authorized to remove a security freeze for a protected consumer or to delete a record of a protected consumer if the security freeze was placed or the record was created based upon a material misrepresentation of fact by the protected consumer or the protected consumers representative.(k)A consumer credit reporting agency may develop procedures involving the use of telephone, mail, fax, the Internet, or other electronic media to receive and process a request for a protected consumers security freeze to be placed or removed.SEC. 2.This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the California Constitution and shall go into immediate effect. The facts constituting the necessity are:To remove barriers for the representatives of protected consumers, who may be the victims of data breaches, to freeze the credit reports, and to protect the identity of protected consumers as soon as possible, it is necessary that this bill take effect immediately.(a)A consumer credit reporting agency shall place a security freeze for a protected consumer if both of the following occur:
(1)The consumer credit reporting agency receives a request from the protected consumers representative for the placement of the security freeze pursuant to this section.
(2)The protected consumers representative does all of the following:
(A)Submits the request to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.
(B)Provides to the consumer credit reporting agency sufficient proof of identification of the protected consumer and the representative.
(C)Provides to the consumer credit reporting agency sufficient proof of authority to act on behalf of the protected consumer.
(b)If a consumer credit reporting agency does not have a file pertaining to a protected consumer when the consumer credit reporting agency receives a request pursuant to paragraph (1) of subdivision (a), the consumer credit reporting agency shall create a record for the protected consumer.
(c)If a protected consumers representative requests a security freeze, the consumer credit reporting agency shall disclose the process for placing and removing a security freeze.
(d)Within 30 days after receiving a request that meets the requirements of subdivision (a), a consumer credit reporting agency shall place a security freeze for the protected consumer. The consumer credit reporting agency shall send written confirmation of the security freeze to the address on file within 10 days of the placement of the security freeze.
(e)Unless a security freeze for a protected consumer is removed pursuant to subdivision (h) or (j), a consumer credit reporting agency shall not release the protected consumers consumer credit report, any information derived from the protected consumers consumer credit report, or any record created for the protected consumer.
(f)A security freeze for a protected consumer placed pursuant to this section shall remain in effect until either of the following occurs:
(1)The protected consumer or the protected consumers representative requests that the consumer credit reporting agency remove the security freeze in accordance with subdivision (h).
(2)The security freeze is removed in accordance with subdivision (j).
(g)To remove a security freeze, a protected consumer or a protected consumers representative shall do both of the following:
(1)Submit a request for removal of the security freeze to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.
(2)Provide to the consumer credit reporting agency:
(A)If the request is made by the protected consumer:
(i)Proof that the sufficient proof of authority for the protected consumers representative to act on behalf of the protected consumer is no longer valid, he or she has been emancipated, or he or she is 16 years of age or older.
(ii)Sufficient proof of identification of the protected consumer.
(B)If the request is made by the representative of a protected consumer:
(i)Sufficient proof of identification of the protected consumer and the representative.
(ii)Sufficient proof of authority to act on behalf of the protected consumer.
(h)Within 30 days after receiving a request that meets the requirements of subdivision (g), a consumer credit reporting agency shall remove a security freeze for a protected consumer.
(i)A consumer credit reporting agency may not charge a fee for any service performed pursuant to this section.
(j)A consumer credit reporting agency is authorized to remove a security freeze for a protected consumer or to delete a record of a protected consumer if the security freeze was placed or the record was created based upon a material misrepresentation of fact by the protected consumer or the protected consumers representative.
(k)A consumer credit reporting agency may develop procedures involving the use of telephone, mail, fax, the Internet, or other electronic media to receive and process a request for a protected consumers security freeze to be placed or removed.
SEC. 2.This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the California Constitution and shall go into immediate effect. The facts constituting the necessity are:
To remove barriers for the representatives of protected consumers, who may be the victims of data breaches, to freeze the credit reports, and to protect the identity of protected consumers as soon as possible, it is necessary that this bill take effect immediately.
(a)A consumer credit reporting agency shall place a security freeze for a protected consumer if both of the following occur:
(1)The consumer credit reporting agency receives a request from the protected consumers representative for the placement of the security freeze pursuant to this section.
(2)The protected consumers representative does all of the following:
(A)Submits the request to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.
(B)Provides to the consumer credit reporting agency sufficient proof of identification of the protected consumer and the representative.
(C)Provides to the consumer credit reporting agency sufficient proof of authority to act on behalf of the protected consumer.
(D)Pays to the consumer credit reporting agency a fee as authorized by subdivision (i).(b)If a consumer credit reporting agency does not have a file pertaining to a protected consumer when the consumer credit reporting agency receives a request pursuant to paragraph (1) of subdivision (a), the consumer credit reporting agency shall create a record for the protected consumer.
(c)If a protected consumers representative requests a security freeze, the consumer credit reporting agency shall disclose the process for placing and removing a security freeze.
(d)Within 30 days after receiving a request that meets the requirements of subdivision (a), a consumer credit reporting agency shall place a security freeze for the protected consumer. The consumer credit reporting agency shall send written confirmation of the security freeze to the address on file within 10 days of the placement of the security freeze.
(e)Unless a security freeze for a protected consumer is removed pursuant to subdivision (h) or (j), a consumer credit reporting agency shall not release the protected consumers consumer credit report, any information derived from the protected consumers consumer credit report, or any record created for the protected consumer.
(f)A security freeze for a protected consumer placed pursuant to this section shall remain in effect until either of the following occurs:
(1)The protected consumer or the protected consumers representative requests that the consumer credit reporting agency remove the security freeze in accordance with subdivision (h).
(2)The security freeze is removed in accordance with subdivision (j).
(g)To remove a security freeze, a protected consumer or a protected consumers representative shall do all both of the following:
(1)Submit a request for removal of the security freeze to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.
(2)Provide to the consumer credit reporting agency:
(A)If the request is made by the protected consumer:
(i)Proof that the sufficient proof of authority for the protected consumers representative to act on behalf of the protected consumer is no longer valid, he or she has been emancipated, or he or she is 16 years of age or older.
(ii)Sufficient proof of identification of the protected consumer.
(B)If the request is made by the representative of a protected consumer:
(i)Sufficient proof of identification of the protected consumer and the representative.
(ii)Sufficient proof of authority to act on behalf of the protected consumer.
(3)Pay to the consumer credit reporting agency a fee as authorized by subdivision (i).(h)Within 30 days after receiving a request that meets the requirements of subdivision (g), a consumer credit reporting agency shall remove a security freeze for a protected consumer.
(i)(1)Except as provided in paragraph (2), a A consumer credit reporting agency may not charge a fee for any service performed pursuant to this section.
(2)A consumer credit reporting agency is authorized to charge a reasonable fee, not exceeding ten dollars ($10), for each placement or removal of a security freeze for a protected consumer.(3)Notwithstanding paragraph (2), a consumer credit reporting agency shall not charge any fee pursuant to this section under any of the following circumstances:(A)The protected consumers representative has received a report of alleged identity theft against the protected consumer under Section 530.5 of the Penal Code and has provided copy of the report to the consumer credit reporting agency.(B)The request for the placement or removal of a security freeze is for a protected consumer who is under 16 years of age at the time of the request and the consumer credit reporting agency has a report pertaining to the protected consumer.(C)The request for the placement or removal of a security freeze is for a protected consumer who has been placed in a foster care setting.(j)A consumer credit reporting agency is authorized to remove a security freeze for a protected consumer or to delete a record of a protected consumer if the security freeze was placed or the record was created based upon a material misrepresentation of fact by the protected consumer or the protected consumers representative.
(k)A consumer credit reporting agency may develop procedures involving the use of telephone, mail, fax, the Internet, or other electronic media to receive and process a request for a protected consumers security freeze to be placed or removed.
SECTION 1.Section 1546.1 of the Penal Code is amended to read:1546.1.(a)Except as provided in this section, a government entity shall not do any of the following:(1)Compel the production of or access to electronic communication information from a service provider.(2)Compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device.(3)Access electronic device information by means of physical interaction or electronic communication with the electronic device. This section does not prohibit the intended recipient of an electronic communication from voluntarily disclosing electronic communication information concerning that communication to a government entity.(b)A government entity may compel the production of or access to electronic communication information from a service provider, or compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device only under the following circumstances:(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.(3)Pursuant to an order for electronic reader records issued pursuant to Section 1798.90 of the Civil Code.(4)Pursuant to a subpoena issued pursuant to existing state law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense, and compelling the production of or access to the information via the subpoena is not otherwise prohibited by state or federal law. Nothing in this paragraph shall be construed to expand any authority under state law to compel the production of or access to electronic information.(5)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.(c)A government entity may access electronic device information by means of physical interaction or electronic communication with the device only as follows:(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.(3)Pursuant to a tracking device search warrant issued pursuant to paragraph (12) of subdivision (a) of Section 1524 and subdivision (b) of Section 1534.(4)With the specific consent of the authorized possessor of the device.(5)With the specific consent of the owner of the device, only when the device has been reported as lost or stolen.(6)If the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to the electronic device information.(7)If the government entity, in good faith, believes the device to be lost, stolen, or abandoned, provided that the government entity shall only access electronic device information in order to attempt to identify, verify, or contact the owner or authorized possessor of the device.(8)Except where prohibited by state or federal law, if the device is seized from an inmates possession or found in an area of a correctional facility or a secure area of a local detention facility where inmates have access, the device is not in the possession of an individual, and the device is not known or believed to be the possession of an authorized visitor. This paragraph shall not be construed to supersede or override Section 4576.(9)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is serving a term of parole under the supervision of the Department of Corrections and Rehabilitation or a term of postrelease community supervision under the supervision of county probation.(10)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is subject to an electronic device search as a clear and unambiguous condition of probation, mandatory supervision, or pretrial release.(11)If the government entity accesses information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.(12)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.(d)Any warrant for electronic information shall comply with the following:(1)The warrant shall describe with particularity the information to be seized by specifying, as appropriate and reasonable, the time periods covered, the target individuals or accounts, the applications or services covered, and the types of information sought. The court may determine that it is not appropriate in the warrant described in paragraph (1) of subdivision (c) to specify time periods because of the specific circumstances of the investigation, including, but not limited to, the nature of the device to be searched.(2)The warrant shall require that any information obtained through the execution of the warrant that is unrelated to the objective of the warrant shall be sealed by the government entity obtaining the information and shall not be subject to further review, use, or disclosure except pursuant to a court order or to comply with discovery as required by Sections 1054.1 and 1054.7. A court shall issue such an order upon a finding that there is probable cause to believe that the information is relevant to an active investigation, or review, use, or disclosure is required by state or federal law. As used in this paragraph, sealed means protected by means sufficient to prevent access by physical or electronic means.(3)The warrant shall comply with all other provisions of California and federal law, including any provisions prohibiting, limiting, or imposing additional requirements on the use of search warrants. If directed to a service provider, the warrant shall be accompanied by an order requiring the service provider to verify the authenticity of electronic information that it produces by providing an affidavit that complies with the requirements set forth in Section 1561 of the Evidence Code. Admission of that information into evidence shall be subject to Section 1562 of the Evidence Code.(e)When issuing any warrant or order for electronic information, or upon the petition from the target or recipient of the warrant or order, a court may, at its discretion, do either or both of the following:(1)Appoint a special master, as described in subdivision (d) of Section 1524, charged with ensuring that only information necessary to achieve the objective of the warrant or order is produced or accessed.(2)Require that any information obtained through the execution of the warrant or order that is unrelated to the objective of the warrant be destroyed as soon as feasible after the termination of the current investigation and any related investigations or proceedings, including appellate proceedings.(f)A service provider may voluntarily disclose electronic communication information or subscriber information when that disclosure is not otherwise prohibited by state or federal law.(g)If a government entity receives electronic communication information voluntarily provided pursuant to subdivision (f), it shall destroy that information within 90 days unless one or more of the following circumstances apply:(1)The government entity has or obtains the specific consent of the sender or recipient of the electronic communications about which information was disclosed.(2)The government entity obtains a court order authorizing the retention of the information. A court shall issue a retention order upon a finding that the conditions justifying the initial voluntary disclosure persist, in which case the court shall authorize the retention of the information only for so long as those conditions persist, or there is probable cause to believe that the information constitutes evidence that a crime has been committed.(3)The government entity reasonably believes that the information relates to child pornography and the information is retained as part of a multiagency database used in the investigation of child pornography and related crimes.(4)The service provider or subscriber is, or discloses the information to, a federal, state, or local prison, jail, or juvenile detention facility, and all participants to the electronic communication were informed, prior to the communication, that the service provider may disclose the information to the government entity.(h)If a government entity obtains electronic information pursuant to an emergency involving danger of death or serious physical injury to a person, that requires access to the electronic information without delay, the government entity shall, within three court days after obtaining the electronic information, file with the appropriate court an application for a warrant or order authorizing obtaining the electronic information or a motion seeking approval of the emergency disclosures that shall set forth the facts giving rise to the emergency, and if applicable, a request supported by a sworn affidavit for an order delaying notification under paragraph (1) of subdivision (b) of Section 1546.2. The court shall promptly rule on the application or motion and shall order the immediate destruction of all information obtained, and immediate notification pursuant to subdivision (a) of Section 1546.2 if that notice has not already been given, upon a finding that the facts did not give rise to an emergency or upon rejecting the warrant or order application on any other ground. This subdivision does not apply if the government entity obtains information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.(i)This section does not limit the authority of a government entity to use an administrative, grand jury, trial, or civil discovery subpoena to do any of the following:(1)Require an originator, addressee, or intended recipient of an electronic communication to disclose any electronic communication information associated with that communication.(2)Require an entity that provides electronic communications services to its officers, directors, employees, or agents for the purpose of carrying out their duties, to disclose electronic communication information associated with an electronic communication to or from an officer, director, employee, or agent of the entity.(3)Require a service provider to provide subscriber information.(j)This section does not limit the authority of the Public Utilities Commission or the State Energy Resources Conservation and Development Commission to obtain energy or water supply and consumption information pursuant to the powers granted to them under the Public Utilities Code or the Public Resources Code and other applicable state laws.(k)This chapter shall not be construed to alter the authority of a government entity that owns an electronic device to compel an employee who is authorized to possess the device to return the device to the government entitys possession.(a)Except as provided in this section, a government entity shall not do any of the following:
(1)Compel the production of or access to electronic communication information from a service provider.
(2)Compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device.
(3)Access electronic device information by means of physical interaction or electronic communication with the electronic device. This section does not prohibit the intended recipient of an electronic communication from voluntarily disclosing electronic communication information concerning that communication to a government entity.
(b)A government entity may compel the production of or access to electronic communication information from a service provider, or compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device only under the following circumstances:
(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).
(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.
(3)Pursuant to an order for electronic reader records issued pursuant to Section 1798.90 of the Civil Code.
(4)Pursuant to a subpoena issued pursuant to existing state law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense, and compelling the production of or access to the information via the subpoena is not otherwise prohibited by state or federal law. Nothing in this paragraph shall be construed to expand any authority under state law to compel the production of or access to electronic information.
(5)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.
(c)A government entity may access electronic device information by means of physical interaction or electronic communication with the device only as follows:
(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).
(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.
(3)Pursuant to a tracking device search warrant issued pursuant to paragraph (12) of subdivision (a) of Section 1524 and subdivision (b) of Section 1534.
(4)With the specific consent of the authorized possessor of the device.
(5)With the specific consent of the owner of the device, only when the device has been reported as lost or stolen.
(6)If the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to the electronic device information.
(7)If the government entity, in good faith, believes the device to be lost, stolen, or abandoned, provided that the government entity shall only access electronic device information in order to attempt to identify, verify, or contact the owner or authorized possessor of the device.
(8)Except where prohibited by state or federal law, if the device is seized from an inmates possession or found in an area of a correctional facility or a secure area of a local detention facility where inmates have access, the device is not in the possession of an individual, and the device is not known or believed to be the possession of an authorized visitor. This paragraph shall not be construed to supersede or override Section 4576.
(9)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is serving a term of parole under the supervision of the Department of Corrections and Rehabilitation or a term of postrelease community supervision under the supervision of county probation.
(10)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is subject to an electronic device search as a clear and unambiguous condition of probation, mandatory supervision, or pretrial release.
(11)If the government entity accesses information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.
(12)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.
(d)Any warrant for electronic information shall comply with the following:
(1)The warrant shall describe with particularity the information to be seized by specifying, as appropriate and reasonable, the time periods covered, the target individuals or accounts, the applications or services covered, and the types of information sought. The court may determine that it is not appropriate in the warrant described in paragraph (1) of subdivision (c) to specify time periods because of the specific circumstances of the investigation, including, but not limited to, the nature of the device to be searched.
(2)The warrant shall require that any information obtained through the execution of the warrant that is unrelated to the objective of the warrant shall be sealed by the custodian government entity obtaining the information and shall not be subject to further review, use, or disclosure except pursuant to a court order or to comply with discovery as required by Sections 1054.1 and 1054.7. A court shall issue such an order upon a finding that there is probable cause to believe that the information is relevant to an active investigation, or review, use, or disclosure is required by state or federal law. As used in this paragraph, sealed means protected by means sufficient to prevent access by physical or electronic means, including through encryption of electronic information, such that the electronic information is unreadable by the government agency. means.
(3)The warrant shall comply with all other provisions of California and federal law, including any provisions prohibiting, limiting, or imposing additional requirements on the use of search warrants. If directed to a service provider, the warrant shall be accompanied by an order requiring the service provider to verify the authenticity of electronic information that it produces by providing an affidavit that complies with the requirements set forth in Section 1561 of the Evidence Code. Admission of that information into evidence shall be subject to Section 1562 of the Evidence Code.
(e)When issuing any warrant or order for electronic information, or upon the petition from the target or recipient of the warrant or order, a court may, at its discretion, do either or both of the following:
(1)Appoint a special master, as described in subdivision (d) of Section 1524, charged with ensuring that only information necessary to achieve the objective of the warrant or order is produced or accessed.
(2)Require that any information obtained through the execution of the warrant or order that is unrelated to the objective of the warrant be destroyed or returned as soon as feasible after the termination of the current investigation and any related investigations or proceedings, including appellate proceedings.
(f)A service provider may voluntarily disclose electronic communication information or subscriber information when that disclosure is not otherwise prohibited by state or federal law.
(g)If a government entity receives electronic communication information voluntarily provided pursuant to subdivision (f), it shall destroy that information within 90 days unless one or more of the following circumstances apply:
(1)The government entity has or obtains the specific consent of the sender or recipient of the electronic communications about which information was disclosed.
(2)The government entity obtains a court order authorizing the retention of the information. A court shall issue a retention order upon a finding that the conditions justifying the initial voluntary disclosure persist, in which case the court shall authorize the retention of the information only for so long as those conditions persist, or there is probable cause to believe that the information constitutes evidence that a crime has been committed.
(3)The government entity reasonably believes that the information relates to child pornography and the information is retained as part of a multiagency database used in the investigation of child pornography and related crimes.
(4)The service provider or subscriber is, or discloses the information to, a federal, state, or local prison, jail, or juvenile detention facility, and all participants to the electronic communication were informed, prior to the communication, that the service provider may disclose the information to the government entity.
(h)If a government entity obtains electronic information pursuant to an emergency involving danger of death or serious physical injury to a person, that requires access to the electronic information without delay, the government entity shall, within three court days after obtaining the electronic information, file with the appropriate court an application for a warrant or order authorizing obtaining the electronic information or a motion seeking approval of the emergency disclosures that shall set forth the facts giving rise to the emergency, and if applicable, a request supported by a sworn affidavit for an order delaying notification under paragraph (1) of subdivision (b) of Section 1546.2. The court shall promptly rule on the application or motion and shall order the immediate destruction of all information obtained, and immediate notification pursuant to subdivision (a) of Section 1546.2 if that notice has not already been given, upon a finding that the facts did not give rise to an emergency or upon rejecting the warrant or order application on any other ground. This subdivision does not apply if the government entity obtains information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.
(i)This section does not limit the authority of a government entity to use an administrative, grand jury, trial, or civil discovery subpoena to do any of the following:
(1)Require an originator, addressee, or intended recipient of an electronic communication to disclose any electronic communication information associated with that communication.
(2)Require an entity that provides electronic communications services to its officers, directors, employees, or agents for the purpose of carrying out their duties, to disclose electronic communication information associated with an electronic communication to or from an officer, director, employee, or agent of the entity.
(3)Require a service provider to provide subscriber information.
(j)This section does not limit the authority of the Public Utilities Commission or the State Energy Resources Conservation and Development Commission to obtain energy or water supply and consumption information pursuant to the powers granted to them under the Public Utilities Code or the Public Resources Code and other applicable state laws.
(k)This chapter shall not be construed to alter the authority of a government entity that owns an electronic device to compel an employee who is authorized to possess the device to return the device to the government entitys possession.
(a)Except as provided in this section, a government entity shall not do any of the following:
(1)Compel the production of or access to electronic communication information from a service provider.
(2)Compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device.
(3)Access electronic device information by means of physical interaction or electronic communication with the electronic device. This section does not prohibit the intended recipient of an electronic communication from voluntarily disclosing electronic communication information concerning that communication to a government entity.
(b)A government entity may compel the production of or access to electronic communication information from a service provider, or compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device only under the following circumstances:
(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).
(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.
(3)Pursuant to an order for electronic reader records issued pursuant to Section 1798.90 of the Civil Code.
(4)Pursuant to a subpoena issued pursuant to existing state law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense, and compelling the production of or access to the information via the subpoena is not otherwise prohibited by state or federal law. Nothing in this paragraph shall be construed to expand any authority under state law to compel the production of or access to electronic information.
(5)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.
(c)A government entity may access electronic device information by means of physical interaction or electronic communication with the device only as follows:
(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).
(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.
(3)Pursuant to a tracking device search warrant issued pursuant to paragraph (12) of subdivision (a) of Section 1524 and subdivision (b) of Section 1534.
(4)With the specific consent of the authorized possessor of the device.
(5)With the specific consent of the owner of the device, only when the device has been reported as lost or stolen.
(6)If the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to the electronic device information.
(7)If the government entity, in good faith, believes the device to be lost, stolen, or abandoned, provided that the government entity shall only access electronic device information in order to attempt to identify, verify, or contact the owner or authorized possessor of the device.
(8)Except where prohibited by state or federal law, if the device is seized from an inmates possession or found in an area of a correctional facility or a secure area of a local detention facility where inmates have access, the device is not in the possession of an individual, and the device is not known or believed to be the possession of an authorized visitor. This paragraph shall not be construed to supersede or override Section 4576.
(9)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is serving a term of parole under the supervision of the Department of Corrections and Rehabilitation or a term of postrelease community supervision under the supervision of county probation.
(10)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is subject to an electronic device search as a clear and unambiguous condition of probation, mandatory supervision, or pretrial release.
(11)If the government entity accesses information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.
(12)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.
(d)Any warrant for electronic information shall comply with the following:
(1)The warrant shall describe with particularity the information to be seized by specifying, as appropriate and reasonable, the time periods covered, the target individuals or accounts, the applications or services covered, and the types of information sought. The court may determine that it is not appropriate in the warrant described in paragraph (1) of subdivision (c) to specify time periods because of the specific circumstances of the investigation, including, but not limited to, the nature of the device to be searched.
(2)The warrant shall require that any information obtained through the execution of the warrant that is unrelated to the objective of the warrant shall be sealed by the court custodian and shall not be subject to further review, use, or disclosure except pursuant to a court order or to comply with discovery as required by Sections 1054.1 and 1054.7. A court shall issue such an order upon a finding that there is probable cause to believe that the information is relevant to an active investigation, or review, use, or disclosure is required by state or federal law. As used in this paragraph, sealed means protected by means sufficient to prevent access by physical or electronic means, including through encryption of electronic information, such that the electronic information is unreadable by the government agency.
(3)The warrant shall comply with all other provisions of California and federal law, including any provisions prohibiting, limiting, or imposing additional requirements on the use of search warrants. If directed to a service provider, the warrant shall be accompanied by an order requiring the service provider to verify the authenticity of electronic information that it produces by providing an affidavit that complies with the requirements set forth in Section 1561 of the Evidence Code. Admission of that information into evidence shall be subject to Section 1562 of the Evidence Code.
(e)When issuing any warrant or order for electronic information, or upon the petition from the target or recipient of the warrant or order, a court may, at its discretion, do either or both of the following:
(1)Appoint a special master, as described in subdivision (d) of Section 1524, charged with ensuring that only information necessary to achieve the objective of the warrant or order is produced or accessed.
(2)Require that any information obtained through the execution of the warrant or order that is unrelated to the objective of the warrant be destroyed or returned as soon as feasible after the termination of the current investigation and any related investigations or proceedings, including appellate proceedings.
(f)A service provider may voluntarily disclose electronic communication information or subscriber information when that disclosure is not otherwise prohibited by state or federal law.
(g)If a government entity receives electronic communication information voluntarily provided pursuant to subdivision (f), it shall destroy that information within 90 days unless one or more of the following circumstances apply:
(1)The government entity has or obtains the specific consent of the sender or recipient of the electronic communications about which information was disclosed.
(2)The government entity obtains a court order authorizing the retention of the information. A court shall issue a retention order upon a finding that the conditions justifying the initial voluntary disclosure persist, in which case the court shall authorize the retention of the information only for so long as those conditions persist, or there is probable cause to believe that the information constitutes evidence that a crime has been committed.
(3)The government entity reasonably believes that the information relates to child pornography and the information is retained as part of a multiagency database used in the investigation of child pornography and related crimes.
(4)The service provider or subscriber is, or discloses the information to, a federal, state, or local prison, jail, or juvenile detention facility, and all participants to the electronic communication were informed, prior to the communication, that the service provider may disclose the information to the government entity.
(h)If a government entity obtains electronic information pursuant to an emergency involving danger of death or serious physical injury to a person, that requires access to the electronic information without delay, the government entity shall, within three court days after obtaining the electronic information, file with the appropriate court an application for a warrant or order authorizing obtaining the electronic information or a motion seeking approval of the emergency disclosures that shall set forth the facts giving rise to the emergency, and if applicable, a request supported by a sworn affidavit for an order delaying notification under paragraph (1) of subdivision (b) of Section 1546.2. The court shall promptly rule on the application or motion and shall order the immediate destruction of all information obtained, and immediate notification pursuant to subdivision (a) of Section 1546.2 if that notice has not already been given, upon a finding that the facts did not give rise to an emergency or upon rejecting the warrant or order application on any other ground. This subdivision does not apply if the government entity obtains information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.
(i)This section does not limit the authority of a government entity to use an administrative, grand jury, trial, or civil discovery subpoena to do any of the following:
(1)Require an originator, addressee, or intended recipient of an electronic communication to disclose any electronic communication information associated with that communication.
(2)Require an entity that provides electronic communications services to its officers, directors, employees, or agents for the purpose of carrying out their duties, to disclose electronic communication information associated with an electronic communication to or from an officer, director, employee, or agent of the entity.
(3)Require a service provider to provide subscriber information.
(j)This section does not limit the authority of the Public Utilities Commission or the State Energy Resources Conservation and Development Commission to obtain energy or water supply and consumption information pursuant to the powers granted to them under the Public Utilities Code or the Public Resources Code and other applicable state laws.
(k)This chapter shall not be construed to alter the authority of a government entity that owns an electronic device to compel an employee who is authorized to possess the device to return the device to the government entitys possession.
(a)Except as provided in this section, a government entity shall not do any of the following:
(1)Compel the production of or access to electronic communication information from a service provider.
(2)Compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device.
(3)Access electronic device information by means of physical interaction or electronic communication with the electronic device. This section does not prohibit the intended recipient of an electronic communication from voluntarily disclosing electronic communication information concerning that communication to a government entity.
(b)A government entity may compel the production of or access to electronic communication information from a service provider, or compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device only under the following circumstances:
(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).
(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.
(3)Pursuant to an order for electronic reader records issued pursuant to Section 1798.90 of the Civil Code.
(4)Pursuant to a subpoena issued pursuant to existing state law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense, and compelling the production of or access to the information via the subpoena is not otherwise prohibited by state or federal law. Nothing in this paragraph shall be construed to expand any authority under state law to compel the production of or access to electronic information.
(5)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.
(c)A government entity may access electronic device information by means of physical interaction or electronic communication with the device only as follows:
(1)Pursuant to a warrant issued pursuant to Chapter 3 (commencing with Section 1523) and subject to subdivision (d).
(2)Pursuant to a wiretap order issued pursuant to Chapter 1.4 (commencing with Section 629.50) of Title 15 of Part 1.
(3)Pursuant to a tracking device search warrant issued pursuant to paragraph (12) of subdivision (a) of Section 1524 and subdivision (b) of Section 1534.
(4)With the specific consent of the authorized possessor of the device.
(5)With the specific consent of the owner of the device, only when the device has been reported as lost or stolen.
(6)If the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to the electronic device information.
(7)If the government entity, in good faith, believes the device to be lost, stolen, or abandoned, provided that the government entity shall only access electronic device information in order to attempt to identify, verify, or contact the owner or authorized possessor of the device.
(8)Except where prohibited by state or federal law, if the device is seized from an inmates possession or found in an area of a correctional facility or a secure area of a local detention facility where inmates have access, the device is not in the possession of an individual, and the device is not known or believed to be the possession of an authorized visitor. This paragraph shall not be construed to supersede or override Section 4576.
(9)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is serving a term of parole under the supervision of the Department of Corrections and Rehabilitation or a term of postrelease community supervision under the supervision of county probation.
(10)Except where prohibited by state or federal law, if the device is seized from an authorized possessor of the device who is subject to an electronic device search as a clear and unambiguous condition of probation, mandatory supervision, or pretrial release.
(11)If the government entity accesses information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.
(12)Pursuant to an order for a pen register or trap and trace device, or both, issued pursuant to Chapter 1.5 (commencing with Section 630) of Title 15 of Part 1.
(d)Any warrant for electronic information shall comply with the following:
(1)The warrant shall describe with particularity the information to be seized by specifying, as appropriate and reasonable, the time periods covered, the target individuals or accounts, the applications or services covered, and the types of information sought, provided, however, that in the case of a warrant described in paragraph (1) of subdivision (c), the sought. The court may determine that it is not appropriate in the warrant described in paragraph (1) of subdivision (c) to specify time periods because of the specific circumstances of the investigation, including, but not limited to, the nature of the device to be searched.
(2)The warrant shall require that any information obtained through the execution of the warrant that is unrelated to the objective of the warrant shall be sealed by the court and shall not be subject to further review, use, or disclosure except pursuant to a court order or to comply with discovery as required by Sections 1054.1 and 1054.7. A court shall issue such an order upon a finding that there is probable cause to believe that the information is relevant to an active investigation, or review, use, or disclosure is required by state or federal law. As used in this paragraph, sealed means protected by means sufficient to prevent access by physical or electronic means, including through encryption of electronic information, such that the electronic information is unreadable by the government agency.
(3)The warrant shall comply with all other provisions of California and federal law, including any provisions prohibiting, limiting, or imposing additional requirements on the use of search warrants. If directed to a service provider, the warrant shall be accompanied by an order requiring the service provider to verify the authenticity of electronic information that it produces by providing an affidavit that complies with the requirements set forth in Section 1561 of the Evidence Code. Admission of that information into evidence shall be subject to Section 1562 of the Evidence Code.
(e)When issuing any warrant or order for electronic information, or upon the petition from the target or recipient of the warrant or order, a court may, at its discretion, do either or both of the following:
(1)Appoint a special master, as described in subdivision (d) of Section 1524, charged with ensuring that only information necessary to achieve the objective of the warrant or order is produced or accessed.
(2)Require that any information obtained through the execution of the warrant or order that is unrelated to the objective of the warrant be destroyed or returned as soon as feasible after the termination of the current investigation and any related investigations or proceedings. proceedings, including appellate proceedings.
(f)A service provider may voluntarily disclose electronic communication information or subscriber information when that disclosure is not otherwise prohibited by state or federal law.
(g)If a government entity receives electronic communication information voluntarily provided pursuant to subdivision (f), it shall destroy that information within 90 days unless one or more of the following circumstances apply:
(1)The government entity has or obtains the specific consent of the sender or recipient of the electronic communications about which information was disclosed.
(2)The government entity obtains a court order authorizing the retention of the information. A court shall issue a retention order upon a finding that the conditions justifying the initial voluntary disclosure persist, in which case the court shall authorize the retention of the information only for so long as those conditions persist, or there is probable cause to believe that the information constitutes evidence that a crime has been committed.
(3)The government entity reasonably believes that the information relates to child pornography and the information is retained as part of a multiagency database used in the investigation of child pornography and related crimes.
(4)The service provider or subscriber is, or discloses the information to, a federal, state, or local prison, jail, or juvenile detention facility, and all participants to the electronic communication were informed, prior to the communication, that the service provider may disclose the information to the government entity.
(h)If a government entity obtains electronic information pursuant to an emergency involving danger of death or serious physical injury to a person, that requires access to the electronic information without delay, the government entity shall, within three court days after obtaining the electronic information, file with the appropriate court an application for a warrant or order authorizing obtaining the electronic information or a motion seeking approval of the emergency disclosures that shall set forth the facts giving rise to the emergency, and if applicable, a request supported by a sworn affidavit for an order delaying notification under paragraph (1) of subdivision (b) of Section 1546.2. The court shall promptly rule on the application or motion and shall order the immediate destruction of all information obtained, and immediate notification pursuant to subdivision (a) of Section 1546.2 if that notice has not already been given, upon a finding that the facts did not give rise to an emergency or upon rejecting the warrant or order application on any other ground. This subdivision does not apply if the government entity obtains information concerning the location or the telephone number of the electronic device in order to respond to an emergency 911 call from that device.
(i)This section does not limit the authority of a government entity to use an administrative, grand jury, trial, or civil discovery subpoena to do any of the following:
(1)Require an originator, addressee, or intended recipient of an electronic communication to disclose any electronic communication information associated with that communication.
(2)Require an entity that provides electronic communications services to its officers, directors, employees, or agents for the purpose of carrying out their duties, to disclose electronic communication information associated with an electronic communication to or from an officer, director, employee, or agent of the entity.
(3)Require a service provider to provide subscriber information.
(j)This section does not limit the authority of the Public Utilities Commission or the State Energy Resources Conservation and Development Commission to obtain energy or water supply and consumption information pursuant to the powers granted to them under the Public Utilities Code or the Public Resources Code and other applicable state laws.
(k)This chapter shall not be construed to alter the authority of a government entity that owns an electronic device to compel an employee who is authorized to possess the device to return the device to the government entitys possession.
|
Date
|
Status
|
|---|---|
| Aug 9, 2018 | In committee: Set, first hearing. Hearing canceled at the request of author. |
| Aug 8, 2018 | Re-referred to Com. on B., P. & E.D. |
| Jul 3, 2018 | Withdrawn from committee. |
| Jul 2, 2018 | From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on JUD. |
| Jun 6, 2018 | In committee: Set, first hearing. Hearing canceled at the request of author. |
| Mar 15, 2018 | Re-referred to Com. on JUD. |
| Feb 13, 2018 | Referred to Com. on RLS. |
| Jan 16, 2018 | In Senate. Read first time. To Com. on RLS. for assignment. |
| Jan 16, 2018 | Read third time. Passed. Ordered to the Senate. |
| Jan 10, 2018 | Read second time. Ordered to third reading. |
| Jan 9, 2018 | From committee: Do pass. (Ayes 11. Noes 0.) (January 8). |
| Jan 3, 2018 | From committee chair, with author's amendments: Amend, and re-refer to Com. on PUB. S. Read second time and amended. |
| May 4, 2017 | Re-referred to Com. on PUB. S. |
| May 3, 2017 | From committee chair, with author's amendments: Amend, and re-refer to Com. on PUB. S. Read second time and amended. |
| May 3, 2017 | From committee: Do pass and re-refer to Com. on PUB. S. (Ayes 10. Noes 0.) (May 2). Re-referred to Com. on PUB. S. |
| Apr 17, 2017 | In committee: Hearing postponed by committee. |
| Mar 2, 2017 | Re-referred to Com. on P. & C.P. |
| Mar 1, 2017 | From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended. |
| Feb 27, 2017 | Referred to Coms. on P. & C.P. and PUB. S. |
| Feb 15, 2017 | From printer. May be heard in committee March 17. |
| Feb 14, 2017 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Jan 16, 2018 | AB 608 IRWIN Assembly Third Reading | Assembly Floor |
Passed |
|
| Jan 8, 2018 | Do pass. | Assembly Standing Committee on Banking and Finance |
Passed |
|
| May 2, 2017 | Do pass and be re-referred to the Committee on [Public Safety] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| California District Attorneys Association | * Neutral | May 2, 2017 |
| California Police Chiefs Association | ** Support | Apr 28, 2017 |
| CALPIRG | ** Support | Jan 5, 2018 |
| Electronic Frontier Foundation | ** Against | Apr 28, 2017 |
ASSEMBLY THIRD READING
ATR Bill Id:AB 608
Author:(Irwin)
As Amended Ver:January 3, 2018
Majority vote
Committee | Votes | Ayes | Noes |
Privacy | 10-0 | Chau, Kiley, Baker, Berman, Calderon, Dababneh, Irwin, Kalra, Obernolte, Reyes | |
Banking | 11-0 | Limón, Chen, Acosta, Burke, Calderon, Cervantes, Choi, Gonzalez Fletcher, Grayson, Mark Stone, Weber |
SUMMARY: Prohibits consumer credit reporting agencies (CCRAs) from charging a fee to place or remove a security freeze on the credit file of a protected consumer.
Specifically, this bill:
- Deletes the requirement in Civil Code 1785.11.11 that a protected consumer's representative shall pay a fee to place a security freeze on the credit file of a protected consumer.
- Prohibits CCRAs from charging a fee for any service related to placing or removing a security freeze on the credit file of a protected consumer.
EXISTING LAW:
- Regulates CCRAs via the Consumer Credit Reporting Agencies Act. (Civil Code, Section 1785.1 et seq. All further references are to the Civil Code)
- Defines the following terms (Section 1785.11.9):
- "Protected consumer" means an individual who is under 16, incapacitated, or under a county welfare or county probation department's jurisdiction;
- "Representative" means a person who provides sufficient proof of authority to act for a protected person, as specified, and would include a county welfare or probation department for a child in foster care, but would not include a foster parent;
- "Security freeze" means a restriction that a CCRA places on a protected consumer's record or file that prohibits the CCRA from releasing any report or information about a protected consumer, except as authorized by statute.
- "Sufficient proof of authority" means documentation that shows a representative has authority to act for a protected consumer, including: a court order; a valid power of attorney; a written, notarized statement; or in the case of a foster child a written communication from a county welfare or probation department specifying that the protected consumer is under the department's jurisdiction;
- "Sufficient proof of identification" means documentation that identifies a protected consumer or a representative, including: a social security number or card; a certified or official copy of a birth certificate; a copy of a California driver's license or identification card or other government-issued identification; a copy of a utility bill that shows name and address; or in the case of a foster child a written communication from a county welfare or probation department certifying that the protected consumer is under the department's jurisdiction.
- Requires a CCRA to place a security freeze upon the request of the protected consumer's representative. The representative must provide sufficient proof of identification and sufficient proof of authority. (Section 1785.11.11(a))
- Requires a CCRA, if it does not have a file on the protected consumer, to create a record for the protected consumer and to place the security freeze within 30 days of receiving a request and to send written confirmation within 10 days of placing the freeze. (Section 1785.11.11(b) (d))
- Prohibits the CCRA from releasing information from a protected consumer's frozen report or record until the protected consumer (or representative) either removes the freeze or the CCRA removes the freeze because of a material misrepresentation of fact. (Section 1785.11.11(e) (f))
- Requires that in order to remove a freeze, the protected consumer (or representative) must submit a request for removal to the CCRA, as specified by the CCRA and meet the same requirements specified above for placing a freeze and allows a consumer to act for him- or herself upon presenting proof of emancipation or that he or she is at least 16 years old. (Section 1785.11.11(g))
- Allows CCRAs to charge a $10 fee for placing or removing a security freeze, unless the protected consumer is a documented identity theft victim, the protected consumer is under 16 and the CCRA has an existing record on the protected consumer at the time of the request, or the request is for a foster child. (Section 1785.11.11(i))
- Exempts from the security freeze (i.e., permits access to "frozen" records for) the following (Section 1785.11.10):
- Banks and other lenders who access a consumer's credit report only for the purpose of reviewing existing accounts the consumer has with the bank or lender.
- Resellers of credit report information.
- Check services or fraud prevention services that issue check fraud and exchange traded fund (ETF) fraud reports; and deposit account information services that issue reports on account closures due to fraud, substantial overdrafts, automated teller machine (ATM) abuse, or similar negative information for use by banks who are reviewing existing consumer accounts.
- Credit monitoring services when the protected consumer (or the representatives) has subscribed to the services.
- The protected consumer himself or herself (or the representative) upon request.
- Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
- A child support agency acting under state or federal law to collect child support.
- The Department of Health Care Services acting to investigate Medi-Cal fraud.
- The Franchise Tax Board acting to investigate or collect delinquent taxes, unpaid court orders, or to fulfill its other statutory responsibilities.
FISCAL EFFECT: None.
COMMENTS:
The author states the following:
In light of the Equifax Data Breach, and the information learned from the Joint Oversight Hearing of the Banking and Finance Committee; Privacy and Consumer Protection Committee; and Select Committee on Cybersecurity, fees for security freezes are more appropriately seen as a windfall for the mishandling of consumer data rather than a reasonable service based fee.
Consumer Credit Reporting Agencies profit from the involuntary aggregation of personal consumer data which is packaged and sold to lenders and other financial institutions. Californians should not have to pay a premium to be protected from the misuse of their personal information made possible by the Consumer Credit Reporting business model and the poor security practices of Equifax.
Those who benefit from the Consumer Credit Reporting business model, namely lenders and other financial institutions who seek to profit from extending credit to consumers, are more appropriate targets for fees and charges by the Consumer Credit Reporting Agencies.
In response to the Equifax data breach, consumer advocacy groups and governmental organizations, including the California Department of Business Oversight and the California Attorney General, recommend that consumers consider placing a security freeze on their credit files to prevent fraudulent accounts from being opened in their names. Existing law in California permits CCRAs to charge a fee of up to $10 to process a security freeze. This bill prohibits CCRAs from charging any fee for placing or removing a security freeze on credit files of protected consumers.
Eliminating the $10 fee is likely to increase the number of protected consumers' representatives who elect to place credit freezes. Research in the field of behavioral economics strongly suggests that consumers have a significant response to "free" goods. The label of "free" creates a psychological effect that causes consumers to perceive the good to be more valuable. By removing the fee, California will incentivize higher adoption of credit freezes. A credit freeze significantly lowers the risk that fraudulent lines of credit will be opened in the name of a protected consumer, which provides benefits to both consumers and financial institutions by avoiding costly consequences of fraudulent transactions in the future.
The author's statement frames the fee for security freezes "as a windfall for the mishandling of consumer data rather than a reasonable service based fee." After the Equifax data breach, some equity analysts and other stock market commentators suggested that the company may actually benefit from the breach as consumers seek extra protection and credit monitoring offered by CCRAs. Eliminating the fee for security freezes removes a perverse incentive that rewards CCRAs for misbehavior.
Analysis Prepared by: Michael Burdick / B. & F. / (916) 319-3081 FN: 0002521
Date of Hearing: January 8, 2018
ASSEMBLY COMMITTEE ON BANKING AND FINANCE
Monique Limón, Chair
ABPCA Bill Id:AB 608 (
Author:Irwin) – As Amended Ver:January 3, 2018
SUBJECT: Consumer credit reports: security freezes: protected consumers
SUMMARY: Prohibits consumer credit reporting agencies (CCRAs) from charging a fee to place or remove a security freeze on the credit file of a protected consumer.
Specifically, this bill:
- Deletes the requirement in Civil Code 1785.11.11 that a protected consumer’s representative shall pay a fee to place a security freeze on the credit file of a protected consumer.
- Prohibits CCRAs from charging a fee for any service related to placing or removing a security freeze on the credit file of a protected consumer.
EXISTING LAW:
- Regulates CCRAs via the Consumer Credit Reporting Agencies Act. [Civil Code, Section 1785.1 et seq. All further references are to the Civil Code]
- Defines the following terms [Section 1785.11.9]:
- "Protected consumer" means an individual who is under 16, incapacitated, or under a county welfare or county probation department's jurisdiction;
- "Representative" means a person who provides sufficient proof of authority to act for a protected person, as specified, and would include a county welfare or probation department for a child in foster care, but would not include a foster parent;
- "Security freeze" means a restriction that a CCRA places on a protected consumer's record or file that prohibits the CCRA from releasing any report or information about a protected consumer, except as authorized by statute.
- "Sufficient proof of authority" means documentation that shows a representative has authority to act for a protected consumer, including: a court order; a valid power of attorney; a written, notarized statement; or in the case of a foster child a written communication from a county welfare or probation department specifying that the protected consumer is under the department's jurisdiction;
- "Sufficient proof of identification" means documentation that identifies a protected consumer or a representative, including: a social security number or card; a certified or official copy of a birth certificate; a copy of a California driver's license or identification card or other government-issued identification; a copy of a utility bill that shows name and address; or in the case of a foster child a written communication from a county welfare or probation department certifying that the protected consumer is under the department's jurisdiction.
- Requires a CCRA to place a security freeze upon the request of the protected consumer’s representative. The representative must provide sufficient proof of identification and sufficient proof of authority. [Section 1785.11.11(a)]
- Requires a CCRA, if it does not have a file on the protected consumer, to create a record for the protected consumer and to place the security freeze within 30 days of receiving a request and to send written confirmation within 10 days of placing the freeze. [Section 1785.11.11(b) (d)]
- Prohibits the CCRA from releasing information from a protected consumer's frozen report or record until the protected consumer (or representative) either removes the freeze or the CCRA removes the freeze because of a material misrepresentation of fact. [Section 1785.11.11(e) (f)]
- Requires that in order to remove a freeze, the protected consumer (or representative) must submit a request for removal to the CCRA, as specified by the CCRA and meet the same requirements specified above for placing a freeze and allows a consumer to act for him- or herself upon presenting proof of emancipation or that he or she is at least 16 years old. [Section 1785.11.11(g)]
- Allows CCRAs to charge a $10 fee for placing or removing a security freeze, unless the protected consumer is a documented identity theft victim, the protected consumer is under 16 and the CCRA has an existing record on the protected consumer at the time of the request, or the request is for a foster child. [Section 1785.11.11(i)]
- Exempts from the security freeze (i.e., permits access to "frozen" records for) the following [Section 1785.11.10]:
- Banks and other lenders who access a consumer's credit report only for the purpose of reviewing existing accounts the consumer has with the bank or lender.
- Resellers of credit report information.
- Check services or fraud prevention services that issue check fraud and exchange traded fund (ETF) fraud reports; and deposit account information services that issue reports on account closures due to fraud, substantial overdrafts, automated teller machine (ATM) abuse, or similar negative information for use by banks who are reviewing existing consumer accounts.
- Credit monitoring services when the protected consumer (or the representatives) has subscribed to the services.
- The protected consumer himself or herself (or the representative) upon request.
- Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
- A child support agency acting under state or federal law to collect child support.
- The Department of Health Care Services acting to investigate Medi-Cal fraud.
- The Franchise Tax Board acting to investigate or collect delinquent taxes, unpaid court orders, or to fulfill its other statutory responsibilities.
FISCAL EFFECT: None.
COMMENTS:
The author states the following:
“In light of the Equifax Data Breach, and the information learned from the Joint Oversight Hearing of the Banking and Finance Committee; Privacy and Consumer Protection Committee; and Select Committee on Cybersecurity, fees for security freezes are more appropriately seen as a windfall for the mishandling of consumer data rather than a reasonable service based fee.
Consumer Credit Reporting Agencies profit from the involuntary aggregation of personal consumer data which is packaged and sold to lenders and other financial institutions. Californians should not have to pay a premium to be protected from the misuse of their personal information made possible by the Consumer Credit Reporting business model and the poor security practices of Equifax.
Those who benefit from the Consumer Credit Reporting business model, namely lenders and other financial institutions who seek to profit from extending credit to consumers, are more appropriate targets for fees and charges by the Consumer Credit Reporting Agencies.”
In response to the Equifax data breach, consumer advocacy groups and governmental organizations, including the California Department of Business Oversight and the California Attorney General, recommend that consumers consider placing a security freeze on their credit files to prevent fraudulent accounts from being opened in their names. Existing law in California permits CCRAs to charge a fee of up to $10 to process a security freeze. This bill prohibits CCRAs from charging any fee for placing or removing a security freeze on credit files of protected consumers.
Eliminating the $10 fee is likely to increase the number of protected consumers’ representatives who elect to place credit freezes. Research in the field of behavioral economics strongly suggests that consumers have a significant response to “free” goods. The label of “free” creates a psychological effect that causes consumers to perceive the good to be more valuable. By removing the fee, California will incentivize higher adoption of credit freezes. A credit freeze significantly lowers the risk that fraudulent lines of credit will be opened in the name of a protected consumer, which provides benefits to both consumers and financial institutions by avoiding costly consequences of fraudulent transactions in the future.
The author’s statement frames the fee for security freezes “as a windfall for the mishandling of consumer data rather than a reasonable service based fee.” After the Equifax data breach, some equity analysts and other stock market commentators suggested that the company may actually benefit from the breach as consumers seek extra protection and credit monitoring offered by CCRAs. Eliminating the fee for security freezes removes a perverse incentive that rewards CCRAs for misbehavior.
REGISTERED SUPPORT / OPPOSITION:
Support
CALPIRG
Opposition
Analysis Prepared by: Michael Burdick / B. & F. / (916) 319-3081
Date of Hearing: May 2, 2017
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Ed Chau, Chair
ABPCA Bill Id:AB 608 (
Author:Irwin) – As Amended Ver:March 1, 2017
SUBJECT: Electronic Communications Privacy Act
SUMMARY: Clarifies that information obtained by search warrant that is unrelated to an investigation may be sealed by a court through a variety of physical or electronic means, including encryption. Specifically, this bill:
- Clarifies that a warrant for electronic information that requires that any information obtained through the execution of the warrant that is unrelated to the objective of the warrant shall be sealed by the custodian.
- Defines the term "sealed" to mean "protected by means sufficient to prevent access by physical or electronic means, including through encryption of electronic information, such that the electronic information is unreadable by the government agency".
- Authorizes a court, when issuing a warrant or order for electronic information, or upon the petition from the target or recipient of the warrant or order, to require that unrelated information obtained to be returned as soon as feasible after the termination of the current investigation and any related investigations or proceedings.
- Authorizes a court, when issuing a warrant or order for electronic information, or upon the petition from the target or recipient of the warrant or order, to require that unrelated information obtained be destroyed or returned as soon as feasible after the termination of the current investigation and any related investigations or proceedings, including appellate proceedings.
- Makes other technical or non-substantive amendments.
EXISTING LAW:
- Provides, pursuant to the U.S. Constitution, that “the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched an the persons or things to be seized.” (U.S. Const. amend. IV)
- Enacts the Electronic Communications Privacy Act (CalECPA), which generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions, except for emergency situations. CalECPA also generally specifies the conditions under which a government entity may access electronic device information by means of physical interaction or electronic communication with the device, such as pursuant to a search warrant, wiretap order, or consent of the owner of the device. (Penal Code (PC) Section 1546-1546.4)
- Prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions, except for emergency situations. (PC 1546.1)
- Specifies the conditions under which a government entity may access electronic device information by means of physical interaction or electronic communication with the device, such as pursuant to a search warrant, wiretap order, or consent of the owner of the device. (PC 1546.1)
FISCAL EFFECT: None. This bill has been keyed nonfiscal by the Legislative Counsel.
COMMENTS:
- Purpose of this bill: This bill is intended to better protect electronic information obtained by law enforcement during a warranted search but ultimately unrelated to the objective by clarifying that the "sealing" of that information can be by any means to prevent physical or electronic access, including encryption. This bill is author-sponsored.
- Author's statement: According to the author, "AB 608 is a clarification bill that will help bring uniformity and guidance to law enforcement working under the provisions of Cal ECPA. This bill seeks to codify definitions that incorporate broad best practices as described by stakeholders who serve or receive warrants pursuant to Cal ECPA. This bill will inform the process, but not hamper application to new forms of technology. Californians deserve to have their privacy rights respected no matter where they live across the state of California, and law enforcement deserves clear guidance by the Legislature to ensure the can serve and protect our communities."
- CalECPA "sealing" and "proceedings”: Under California's electronic evidence law (CalECPA), law enforcement must get a court-issued warrant to search for and seize electronic information as part of a criminal investigation. If information is obtained during that search that is not related to the objective of the warrant, then that information must be "sealed" so that it is generally not subject to further review, use, or disclosure. Furthermore, courts may also order that unrelated information be destroyed after an investigation or other "proceedings" are complete.
However, according to the author, law enforcement agencies have complained about the ambiguity of two terms in the statute, "sealed” and "proceedings":
"Existing code sections of Cal-ECPA use the terms 'sealed' and 'proceedings' without any further definition. The term 'sealed' is rarely used in statute, and when it does appear it is in relation to an action conducted by the courts with their own documents. Without further clarification each local law enforcement agency must not only make their own assumption about how to import judicial terms into the law enforcement context, but also apply them to the relatively new and unique forms of electronic evidence. For the term 'proceedings' unless the court clarifies in each warrant it issues, there is no uniform understanding if the term encompasses only trial or also appellate proceedings. This can lead to potentially exonerating evidence being destroyed before the opportunity to appeal a conviction has expired."
In response, this bill would clarify that "sealed" means the prevention of access by physical or electronic means, including encryption, which would be more appropriate to electronic information than, for example, placing hard drives inside of tape-bound paper bags. The bill also clarifies that information can be returned as well as destroyed on completion of any proceedings, which would include appellate proceedings.
- Arguments in support: The California Police Chiefs Association states, "AB 608 clarifies the required procedures regarding handling electronic evidence that is collected by law enforcement, but falls outside the scope of an issued warrant…CalECPA was intended by its author to 'institute a clear, uniform warrant rule for California law enforcement access to electronic information.' However, since its implementation, law enforcement agencies from around the state have raised concerns about the ambiguity of two terms in the statute, 'sealed' and 'proceedings'. The absence of definitions for these two terms has left departments to generate their own best guess, or rely on local district attorneys' interpretations. AB 608 is a clarification bill that will help bring uniformity and guidance to law enforcement working under the provisions of CalECPA."
- Arguments in opposition: The Electronic Frontier Foundation (EFF) takes an oppose unless amended position on the bill, writing "[w]e are concerned that, as written, AB 608 does not clearly preclude the government agency from possessing or having access to the encryption keys needed to read the sealed electronic information. In such situations, the encrypted data might technically be unreadable, but could readily be decrypted. The relevant analogy would be to documents or items kept in a locked safe, but where the government agency has the combination to the lock."
"To address this situation, we suggest that the bill should be amended so that after 'such that the electronic information is unreadable by the government agency,' language is added to preclude the above situation, such as 'and if the electronic information is encrypted, [the] government agency possesses the encryption keys or keys necessary to read the electronic information, or can obtain or use such key or keys without authorization from the court.'" - Previous legislation: SB 1121 (Leno), Chapter 541, Statutes of 2016, enacted a variety of technical and clarifying "clean-up" changes to CalECPA.
SB 178 (Leno), Chapter 651, Statutes of 2015, created CalECPA, which generally required law enforcement entities to obtain a search warrant before accessing data on an electronic device or from an online service provider.
SB 467 (Leno) of 2013 would have required a search warrant when a governmental agency is seeking the contents of a wire or electronic communication that is stored, held or maintained by a provider. SB 467 was vetoed by Governor Brown, who wrote: "The bill, however, imposes new notice requirements that go beyond those required by federal law and could impede ongoing criminal investigations. I do not think that is wise."
SB 1434 (Leno) of 2012 would have required a government entity to get a search warrant in order to obtain the location information of an electronic device. SB 1434 was vetoed by Governor Brown, who wrote: "It may be that legislative action is needed to keep the law current in our rapidly evolving electronic age. But I am not convinced that this bill strikes the right balance between the operational needs of law enforcement and individual expectations of privacy."
SB 914 (Leno) of 2011 would have required a search warrant to search the contents of a portable electronic device that is found during a search incident to an arrest. SB 914 was vetoed by Governor Brown, who wrote: "This measure would overturn a California Supreme Court decision that held that police officers can lawfully search the cell phones of people who they arrest. The courts are better suited to resolve the complex and case-specific issues relating to constitutional search-and-seizures protections."
- Double-referral: This bill is double-referred to the Assembly Public Safety Committee, where this bill will be heard if it passes this Committee.
REGISTERED SUPPORT / OPPOSITION:
Support
California Police Chiefs Association
Opposition
Electronic Frontier Foundation (neutral if amended)
Analysis Prepared by: Hank Dempsey / P. & C.P. /
Discussed in Hearing
1MIN
Assembly Floor
9MIN
Assembly Standing Committee on Privacy and Consumer Protection
Bill Author
