Existing law provides that every person who willfully obtains personal identifying information, as defined, of another person without the authorization of that person, and uses that information for any unlawful purpose in the name of the other person without the consent of that person is guilty of a public offense. Existing law further provides that a person who learns or reasonably suspects that his or her personal identifying information has been used by another to commit a crime may initiate a law enforcement investigation by contacting the local law enforcement agency. Under existing law, the law enforcement agency must take a police report of the matter and provide the complainant with a copy of that report.

This bill would authorize a person who has learned or reasonably suspects that his or her personal identifying information has been used unlawfully in a business entity filing, as defined, and has obtained the police report described above, to petition a court for a determination of unlawful use of his or her personal identifying information in the filing. Upon making that determination, the bill would require the court to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of, or label, the personal identifying information from publicly accessible electronic indexes and databases. The bill would require the Judicial Council to develop a form for issuing that order and would require that the order be filed with the Secretary of State.

Existing law provides that every person who willfully obtains personal identifying information, as defined, of another person without the authorization of that person, and uses that information for any unlawful purpose in the name of the other person without the consent of that person is guilty of a public offense. Existing law further provides that a person who learns or reasonably suspects that his or her personal identifying information has been used by another to commit a crime may initiate a law enforcement investigation by contacting the local law enforcement agency. Under existing law, the law enforcement agency must take a police report of the matter and provide the complainant with a copy of that report.

This bill would authorize a person who has learned or reasonably suspects that his or her personal identifying information has been used unlawfully in a business entity filing, as defined, and has obtained the police report described above, to petition a court for a determination of unlawful use of his or her personal identifying information in the filing. Upon making that determination, the bill would require the court to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of, or label, the personal identifying information from publicly accessible electronic indexes and databases. The bill would require the Judicial Council to develop a form for issuing that order and would require that the order be filed with the Secretary of State.

Existing law provides that every person who willfully obtains personal identifying information, as defined, of another person without the authorization of that person, and uses that information for any unlawful purpose in the name of the other person without the consent of that person is guilty of a public offense. Existing law further provides that a person who learns or reasonably suspects that his or her personal identifying information has been used by another to commit a crime may initiate a law enforcement investigation by contacting the local law enforcement agency. Under existing law, the law enforcement agency must take a police report of the matter and provide the complainant with a copy of that report.

This bill would authorize a person who has learned or reasonably suspects that his or her personal identifying information has been used unlawfully in a business entity filing, as defined, and has obtained the police report described above, to petition a court for a determination of unlawful use of his or her personal identifying information in the filling. filing. Upon making that determination, the bill would require the court to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of, or label, the personal identifying information from publicly accessible electronic indexes and databases. The bill would require the Judicial Council to develop a form for issuing that order and would require that the order be filed with the Secretary of State.

Existing law provides that every person who willfully obtains personal identifying information, as defined, of another person without the authorization of that person, and uses that information for any unlawful purpose in the name of the other person without the consent of that person is guilty of a public offense. Existing law further provides that a person who learns or reasonably suspects that his or her personal identifying information has been used by another to commit a crime may initiate a law enforcement investigation by contacting the local law enforcement agency. Under existing law, the law enforcement agency must take a police report of the matter and provide the complainant with a copy of that report.

This bill would authorize a person who has learned or reasonably suspects that his or her personal identifying information has been used unlawfully in a business entity filing, as defined, and has obtained the police report described above, to petition a court for a determination of unlawful use of his or her personal identifying information in the filling. Upon making that determination, the bill would require the court to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of, or label, the personal identifying information from publicly accessible electronic indexes and databases. The bill would require the Judicial Council to develop a form for issuing that order and would require that the order be filed with the Secretary of State.

Existing law provides that every person who willfully obtains personal identifying information, as defined, of another person without the authorization of that person, and uses that information for any unlawful purpose in the name of the other person without the consent of that person is guilty of a public offense. Existing law further provides that a person who learns or reasonably suspects that his or her personal identifying information has been used by another to commit a crime may initiate a law enforcement investigation by contacting the local law enforcement agency. Under existing law, the law enforcement agency must take a police report of the matter and provide the complainant with a copy of that report.

This bill would authorize a person who has learned that his or her personal identifying information has been used unlawfully in a business entity filing, as defined, and has obtained the police report described above, to petition a court for a determination of unlawful use of his or her personal identifying information in the filling. Upon making that determination, the bill would require the court to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of, or label, the personal identifying information from publicly accessible electronic indexes and databases. The bill would require the Judicial Council to develop a form for issuing that order and would require that the order be filed with the Secretary of State.

 UNFINISHED BUSINESS  

Bill No: SB 1196

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 7-0, 4/24/18

AYES: Jackson, Moorlach, Anderson, Hertzberg, Monning, Stern, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/25/18

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

SENATE FLOOR: 39-0, 5/31/18

AYES: Allen, Anderson, Atkins, Bates, Beall, Berryhill, Bradford, Cannella, De León, Dodd, Fuller, Gaines, Galgiani, Glazer, Hernandez, Hertzberg, Hill, Hueso, Jackson, Lara, Leyva, McGuire, Mitchell, Monning, Moorlach, Morrell, Newman, Nguyen, Nielsen, Pan, Portantino, Roth, Skinner, Stern, Stone, Vidak, Wieckowski, Wiener, Wilk

ASSEMBLY FLOOR: 80-0, 8/27/18 - See last page for vote

SUBJECT:

SOURCE: Secretary of State

DIGEST:

This bill authorizes a person whose personal identifying information has been used unlawfully in a business entity filing, as defined, and has initiated a law enforcement investigation, to petition a court for an order directing the alleged perpetrator of the act and the person using the personal identifying information in the filing to appear and show cause as to why the information should not be labeled to show the information is impersonated and should not be associated with the business entity. This bill provides the relevant court process and requires a court that finds the petition meritorious, to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of the personal identifying information from publicly accessible electronic indexes and databases.

Assembly Amendments

make technical and clarifying changes.

ANALYSIS:

Existing law:

1. Provides, through the California Constitution, that all people are by nature free and independent and have inalienable rights, including enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const, Art. I, Sec. 1.)
2. Defines “personal identifying information” for the purpose of specified penal code provisions to mean any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver’s license, or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother’s maiden name, demand deposit account number, savings account number, checking account number, PIN (personal identification number) or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. (Pen. Code Sec. 530.55.)
3. Provides that every person who willfully obtains personal identifying information of another person and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment pursuant to subdivision (h) of Section 1170. (Pen. Code Sec. 530.5(a).)
4. Provides that a person who has learned or reasonably suspects that their personal identifying information has been unlawfully used by another, as described in subdivision (a) of Section 530.5, may initiate a law enforcement investigation by contacting the local law enforcement agency that has jurisdiction over the person’s actual residence or place of business, which shall take a police report of the matter, provide the complainant with a copy of that report, and begin an investigation of the facts. If the suspected crime was committed in a different jurisdiction, the local law enforcement agency may refer the matter to the law enforcement agency where the suspected crime was committed for further investigation of the facts. (Pen. Code Sec. 530.6(a).)
5. States that legally recognized privacy interests are generally of two classes: interests in precluding the dissemination or misuse of sensitive and confidential information (informational privacy), and interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (autonomy privacy). (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 35.)
6. Authorizes the Attorney General to bring an action against any domestic corporation or purported domestic corporation to procure a judgment dissolving the corporation and annulling, vacating or forfeiting its corporate existence upon specified grounds, including if the corporation has fraudulently abused or usurped corporate privileges or powers. (Corp. Code Sec. 1801.)
7. Provides that a person shall not file or record, or direct another to file or record, a lawsuit, lien, or other encumbrance, including a notice of lis pendens, against another person or entity knowing it is false, with the intent to harass the person or entity or to influence or hinder the person in discharging his or her official duties if the person is a public officer or employee. (Code Civ. Proc. Sec. 765.010(b).)
8. Authorizes a person or entity whose property is subject to a lien or encumbrance in violation of the above provision to petition the superior court of the county in which the person or entity resides or in which the property is located for an order, which may be granted ex parte, directing the lien or other encumbrance claimant to appear at a hearing before the court and show cause why the lien or other encumbrance should not be stricken and why other relief should not be granted. The court shall schedule the hearing no earlier than 14 days after the date of the order. The scheduled date of the hearing shall allow adequate time for notice of the hearing. (Code Civ. Proc. Sec. 765.010(c).) The petition shall state the grounds upon which relief is requested, and shall be supported by the affidavit of the petitioner or the petitioner’s attorney setting forth a concise statement of the facts upon which the motion is based. The petition and affidavit shall be in substantially the form prescribed by the Judicial Council. (Code Civ. Proc. Sec. 765.020.)
9. Provides that if the court determines that the lien or other encumbrance is in violation of Section 765.010, the court shall issue an order striking and releasing the lien or other encumbrance and may award costs and reasonable attorney’s fees to the petitioner to be paid by the lien or other encumbrance claimant. If the court determines that the lien or other encumbrance is valid, the court shall issue an order so stating and may award costs and reasonable attorney’s fees to the encumbrance claimant to be paid by the petitioner. The court may direct that an order issued pursuant to this section be recorded. (Code Civ. Proc. Sec. 765.030.) A claimant to be found in violation shall be liable to the person subject to the lawsuit or the owner of the property bound by the lien or other encumbrance for a civil penalty of up to $5,000. (Code Civ. Proc. Sec. 765.040.)

This bill:

1. Defines “business entity filing” as a document required by law to be filed with the Secretary of State pursuant to the Corporations Code, the Financial Code, or the Insurance Code. “Personal identifying information” has the same meaning as in Section 530.55 of the Penal Code. “Person” is defined as a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity.
2. Provides that a person who has learned or reasonably suspects that their personal identifying information has been used unlawfully in a business entity filing and has initiated a law enforcement investigation may petition the court for an order, which may be granted ex parte, directing the alleged perpetrator of the act, if known, and the person using the personal identifying information in the business entity filing to appear at a hearing before the court and show cause for why the personal identifying information should not be labeled to show the information is impersonated and does not reflect the person’s identity; and why the personal identifying information should be associated with the business entity.
3. Requires that such a petition be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court is required to make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and shall issue an order certifying this determination.
4. Authorizes such a determination to be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.
5. Provides that upon making such a determination, the court must:
   1. order the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity; and
   2. order the data to be removed from publicly accessible electronic indexes and databases.
6. Requires such orders to be filed with the Secretary of State.
7. Requires the Judicial Council to develop a form for issuing an order of determination pursuant to this section.

Background

According to the Federal Trade Commission’s (FTC) “Consumer Sentinel Network Data Book 2017,” California had more identity theft complaints—55,418—than any other state. For every 100,000 people in California, there were 140 identity theft complaints. (FTC, Consumer Sentinel Network Data Book 2017 (Mar. 2018) <https://www.ftc.gov/policy/reports/policy-reports/commission-staff-reports/ consumer-sentinel-network-data-book-2017/state-rankings-id-theft-reports [as of Apr. 5, 2018].)

Identity theft victims’ information can be misused in numerous ways. One of the most common is the creation of new accounts, including credit card, utility, or wireless telephone accounts. But, victims’ information can also be used in other, equally nefarious ways. As the FTC notes:

Once identity thieves have your personal information, they can drain your bank account, run up charges on your credit cards, open new utility accounts, or get medical treatment on your health insurance. An identity thief might even file a tax return in your name and get your refund. In some extreme cases, a thief might even give your name to the police during an arrest.

(FTC, Warning Signs of Identity Theft < https://www.consumer.ftc.gov/articles/ 0271-warning-signs-identity-theft [as of Apr. 11, 2018].)

This bill responds to one particular use of unlawfully obtained personal identifying information: business entity filings. Identity thieves have utilized the personal identifying information of others in order to create new businesses and for other business entity filings. This bill provides a process for a victim of such identity theft to petition a court for an order to redact such information or label it to show it has been impersonated, and to order the data be removed from publicly accessible electronic indexes and databases.

Comments

The author states:

SB 1196 closes a gap in state law important for protecting victims of identity theft. While state law allows for victims to seek judicial remedy in cases where false lien filings are made in their name, state law does not similarly authorize victims to seek judicial remedy when stolen personal identifying information is used in public business entity filings. Unauthorized business entity filings create an additional burden on victims of identity theft, by not only obligating them to undergo extra process to reverse damages resulting from use of their stolen identity, but by continuing to make public the victim’s personal information even after other harms from the identity theft are addressed. This bill creates a simple process for these victims to expeditiously seek recourse, restore their identity, and proceed to recover from the intrusion into their privacy.

Providing another tool for victims of identity theft

California recognizes that the right to privacy is a fundamental right, and has enshrined that right along with other fundamental rights in Article I, Section 1 of the California Constitution.

Unfortunately, because of the size of its economy and the sheer number of consumers, California is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that, in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.”

Over the four-year period from 2012 to 2015, the Attorney General received reports on over 657 breaches, affecting over 49 million records. In 2015 alone, nearly three in five Californians were victims of a data breach. These data breaches are not harmless. The Attorney General reports that in 2014, 67 percent of breach victims in the United States were also victims of fraud.

According to the Secretary of State’s Office, there were reports of eight limited liability companies that were allegedly created as new business entities in 2015, using stolen personal identifying information. However, there is no specific statute authorizing courts to dissolve limited liability companies fraudulently created. While there is authority for the Attorney General to bring an action to shut down a corporation engaging in fraud and authority for courts to grant a victim’s petition to strike a lien or other encumbrance fraudulently filed or recorded, there is no corresponding authority for other business entity filings. The Secretary of State argues that they are not an enforcement agency but simply a filing office that does not have the authority to remove these fraudulent filings without statutory approval.

This bill responds to this gap in the law by authorizing a person whose personal identifying information has been used unlawfully in a business entity filing and who has initiated a law enforcement investigation, to petition the court for an order directing the alleged perpetrator of the act and the person using the personal identifying information in the filing to appear and show cause why the information should not be labeled as impersonated and should not be associated with the business entity.

This bill details the relevant court process, which largely tracks the process provided for victims of fraudulently filed or recorded liens and encumbrances. (See Code Civ. Proc. Sec. 765.010.) Such petitions are heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If, based on that evidence, the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court is required to make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and to issue an order certifying that determination on a form to be created by the Judicial Council. This bill requires such an order to be filed with the Secretary of State.

A court then orders the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity. The court is also required to order the data to be removed from publicly accessible electronic indexes and databases. If at any time the court finds evidence there was a material misrepresentation in the petition, or that the petition was obtained by fraud, it could vacate an earlier determination that the petition was meritorious.

By affording victims of this manner of identity theft an opportunity to disassociate their names from such fraudulent businesses and filings, this bill adds an additional avenue for consumers to protect their identities and their fundamental right to privacy.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According the Assembly Appropriations Committee, this bill would create minor costs to Judicial Council to develop a form.

SUPPORT: (Verified 8/27/18)

Secretary of State (source)

OPPOSITION: (Verified 8/27/18)

None received

ASSEMBLY FLOOR: 80-0, 8/27/18

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bonta, Brough, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Choi, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Flora, Fong, Frazier, Friedman, Gabriel, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Rivas, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

Prepared by:

8/28/18 12:36:33

**** END ****

SENATE THIRD READING

STR Bill Id:SB 1196

Author:(Jackson)

As Amended Ver:August 23, 2018

Majority vote

SENATE VOTE: 39-0

SUMMARY: This bill allows a person whose personal identifying information (PII) has be used unlawfully in a business filing to petition the court to order the PII redacted or labeled as impersonated and removed from public databases, as specified. Specifically, this bill:

1. Provides that a person who has learned or reasonably suspects that their PII has been used unlawfully in a business entity filing, and has initiated a law enforcement investigation, may petition the superior court for an order directing the alleged perpetrator of the act and the person using the PII in the business entity filing to appear at a hearing before the court and show cause for both of the following:
   1. Why the PII should not be labeled to show the information is impersonated and does not reflect the person's identity; and
   2. Why the PII should be associated with the business entity.
2. Requires that such a petition be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If the court determines the petition is meritorious and there is no reasonable cause to believe that the victim's PII has been used lawfully in the business entity filing, the court would be required to make a finding that the victim's PII has been used unlawfully in the business entity filing and issue an order certifying this determination.
3. Provides that upon making such a determination, the court shall do the following:
   1. Order the name and associated PII in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim's identity; and
   2. Order the data to be removed from publicly accessible electronic indexes and databases.
4. Authorizes such a determination to be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.
5. Requires such orders to be filed with the Secretary of State.
6. Requires the Judicial Council of California to develop a form for issuing an order of determination pursuant to these provisions.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California Constitution Article I, Section 1.)
2. Provides that every person who willfully obtains PII of another person and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, as specified. (Penal Code Section 530.5(a).)
3. Provides that a person who has learned or reasonably suspects that their PII has been unlawfully used by another may initiate a law enforcement investigation, as specified. (Penal Code Section 530.6(a).)
4. Authorizes the Attorney General to bring an action against any domestic corporation or purported domestic corporation to procure a judgment dissolving the corporation and annulling, vacating or forfeiting its corporate existence upon any of a set of specified grounds, including if the corporation has fraudulently abused or usurped corporate privileges or powers. (Corporations Code Section 1801.)
5. Defines "PII," for the purpose of specified penal code provisions, to mean any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver's license or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother's maiden name, demand deposit account number, savings account number, checking account number, personal identification number or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. (Penal Code Section 530.55.)

FISCAL EFFECT: According the Assembly Appropriations Committee, this bill would create minor costs to Judicial Council to develop a form.

COMMENTS: Despite California's recognition of privacy as a fundamental right in the state constitution, the size of its economy and the sheer number of consumers, make California residents frequent targets by cyber criminals. The Federal Bureau of Investigation reports that in 2017, California topped the list of where each U.S. state ranks in terms of the number of (1) number of victims of internet-facilitated frauds, (2) dollar losses, and (3) criminal subjects. (Federal Bureau of Investigation, 2017 Internet Crime Report < https://pdf.ic3.gov/ 2017_IC3Report.pdf> [as of June 12, 2018].) The California Secretary of State's Office, sponsor of this bill, further reports that were eight limited liability companies allegedly created as new business entities in 2015 using stolen PII.

Similar to the process provided for victims of fraudulently filed or recorded liens (see Code Civ. Proc. Sec. 765.010), this bill authorizes a person whose PII has been unlawfully used or who reasonably suspects that his or her PII has been unlawfully used in a business entity filing, and who has initiated a law enforcement investigation, to petition the court for an order directing the alleged perpetrator of the act and the person using the PII in the filing to appear and show cause why the information should not be labeled as impersonated and should be associated with the business entity. Such petitions would be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If, based on that evidence, the court determines the petition is meritorious and there is no reasonable cause to believe that the victim's PII has been used lawfully in the business entity filing, the court would be required to make a finding that the victim's PII has been used unlawfully in the business entity filing and to issue an order certifying that determination on a form to be created by the Judicial Council. This bill would require such an order to be filed with the Secretary of State.

A court would then order the name and associated PII in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim's identity. The court would also be required to order the data to be removed from publicly accessible electronic indexes and databases. If at any time the court finds evidence there was a material misrepresentation in the petition, or that the petition was obtained by fraud, it could vacate an earlier determination that the petition was meritorious.

While there is existing authority for the Attorney General to bring an action to shut down a corporation engaging in fraud and existing authority for courts to grant a victim's petition to strike a lien or other encumbrance fraudulently filed or recorded, this bill would allow victims whose PII has been unlawfully used in business filings to petition the court based on that business filing alone. Victims would therefore not need to wait for the Attorney General to bring a claim or wait until a lien has been placed on their property before the unauthorized use of their PII could be brought to the court's attention. Explaining the need for this bill, the author writes, "SB 1196 keeps the full court press on identity thieves by giving state lawmakers a chance to provide victims with a workable solution to a particular form of identity theft used in creating new businesses. Currently, there is no statutory remedy available for a victim of identity theft to remove unauthorized use of their PII from public business entity filings."

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200 FN: 0004409

SENATE THIRD READING

STR Bill Id:SB 1196

Author:(Jackson)

As Amended Ver:June 28, 2018

Majority vote

SENATE VOTE: 39-0

SUMMARY: This bill would allow a person whose personal identifying information (PII) has be used unlawfully in a business filing to petition the court to order the PII redacted or labeled as impersonated and removed from public databases, as specified. Specifically, this bill:

1. Provides that a person who has learned or reasonably suspects that their PII has been used unlawfully in a business entity filing, and has initiated a law enforcement investigation, may petition the superior court for an order directing the alleged perpetrator of the act and the person using the PII in the business entity filing to appear at a hearing before the court and show cause for both of the following:
   1. Why the PII should not be labeled to show the information is impersonated and does not reflect the person's identity; and
   2. Why the PII should be associated with the business entity.
2. Requires that such a petition be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If the court determines the petition is meritorious and there is no reasonable cause to believe that the victim's PII has been used lawfully in the business entity filing, the court would be required to make a finding that the victim's PII has been used unlawfully in the business entity filing and issue an order certifying this determination.
3. Provides that upon making such a determination, the court shall do the following:
   1. Order the name and associated PII in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim's identity; and
   2. Order the data to be removed from publicly accessible electronic indexes and databases.
4. Authorizes such a determination to be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.
5. Requires such orders to be filed with the Secretary of State.
6. Requires the Judicial Council of California to develop a form for issuing an order of determination pursuant to these provisions.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California Constitution article I, Section 1.)
2. Provides that every person who willfully obtains PII of another person and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, as specified. (Penal Code Section 530.5(a).)
3. Provides that a person who has learned or reasonably suspects that their PII has been unlawfully used by another may initiate a law enforcement investigation, as specified. (Penal Code Section 530.6(a).)
4. Authorizes the Attorney General to bring an action against any domestic corporation or purported domestic corporation to procure a judgment dissolving the corporation and annulling, vacating or forfeiting its corporate existence upon any of a set of specified grounds, including if the corporation has fraudulently abused or usurped corporate privileges or powers. (Corporations Code Section 1801.)
5. Defines "PII," for the purpose of specified penal code provisions, to mean any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver's license or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother's maiden name, demand deposit account number, savings account number, checking account number, personal identification number or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. (Pen. Code Sec. 530.55.)

FISCAL EFFECT: According to the Assembly Appropriations Committee, this bill would create minor costs to the Judicial Council to develop a form.

COMMENTS: Despite California's recognition of privacy as a fundamental right in the state constitution, the size of its economy and the sheer number of consumers, make California residents frequent targets by cyber criminals. The Federal Bureau of Investigation reports that in 2017, California topped the list of where each U.S. state ranks in terms of the number of (1) number of victims of internet-facilitated frauds, (2) dollar losses, and (3) criminal subjects. (Federal Bureau of Investigation, 2017 Internet Crime Report < https://pdf.ic3.gov/ 2017_IC3Report.pdf> [as of June 12, 2018].) The California Secretary of State's Office, sponsor of this bill, further reports that were eight limited liability companies allegedly created as new business entities in 2015 using stolen PII.

To that end, similar to the process provided for victims of fraudulently filed or recorded liens (see Code of Civil Procedure Section 765.010), this bill would authorize a person whose PII has been unlawfully used or who reasonably suspects that his or her PII has been unlawfully used in a business entity filing, and who has initiated a law enforcement investigation, to petition the court for an order directing the alleged perpetrator of the act and the person using the PII in the filing to appear and show cause why the information should not be labeled as impersonated and should be associated with the business entity. Such petitions would be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If, based on that evidence, the court determines the petition is meritorious and there is no reasonable cause to believe that the victim's PII has been used lawfully in the business entity filing, the court would be required to make a finding that the victim's PII has been used unlawfully in the business entity filing and to issue an order certifying that determination on a form to be created by the Judicial Council. This bill would require such an order to be filed with the Secretary of State.

A court would then order the name and associated PII in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim's identity. The court would also be required to order the data to be removed from publicly accessible electronic indexes and databases. If at any time the court finds evidence there was a material misrepresentation in the petition, or that the petition was obtained by fraud, it could vacate an earlier determination that the petition was meritorious.

While there is existing authority for the Attorney General to bring an action to shut down a corporation engaging in fraud and existing authority for courts to grant a victim's petition to strike a lien or other encumbrance fraudulently filed or recorded, this bill would allow victims whose PII has been unlawfully used in business filings to petition the court based on that business filing alone. Victims would therefore not need to wait for the Attorney General to bring a claim or wait until a lien has been placed on their property before the unauthorized use of their PII could be brought to the court's attention. Explaining the need for this bill, the author writes, "SB 1196 keeps the full court press on identity thieves by giving state lawmakers a chance to provide victims with a workable solution to a particular form of identity theft used in creating new businesses. Currently, there is no statutory remedy available for a victim of identity theft to remove unauthorized use of their PII from public business entity filings."

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200 FN: 0003979

Date of Hearing: August 8, 2018

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

SBPCA Bill Id:SB 1196

Author:(Jackson) – As Amended Ver:June 28, 2018

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill allows a person whose personal identifying information was used unlawfully in a business filing to petition the court to order the information be redacted or labeled as impersonated and removed from public databases.

FISCAL EFFECT:

Minor costs to Judicial Council to develop a form.

COMMENTS:

Background and purpose. According to the author:

SB 1196 closes a gap in state law important for protecting victims of identity theft. While state law allows for victims to seek judicial remedy in cases where false lien filings are made in their name, state law does not similarly authorize victims to seek judicial remedy when stolen personally identifying information is used in public business entity filings. Unauthorized business entity filings create an additional burden on victims of identity theft, by not only obligating them to undergo extra process to reverse damages resulting from use of their stolen identity, but by continuing to make public the victim’s personal information even after other harms from the identity theft are addressed. This bill creates a simple process for these victims to expeditiously seek recourse, restore their identity, and proceed to recover from the intrusion into their privacy.

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: June 26, 2018

ASSEMBLY COMMITTEE ON JUDICIARY

Mark Stone, Chair

SBPCA Bill Id:SB 1196

Author:(Jackson) – As Introduced Ver:February 15, 2018

PROPOSED CONSENT (As Proposed to be Amended)

SENATE VOTE: 39-0

SUBJECT: Personal identifying information: unlawful use: business entity filings

KEY ISSUE: SHOULD VICTIMS OF IDENTITY THEFT, WHOSE PERSONAL INFORMATION IS WRONGFULLY USED IN A BUSINESS FILING, BE PERMITTED TO SEEK A COURT ORDER REQUIRING THEIR PERSONAL IDENTIFYING INFORMATION BE REMOVED FROM ALL BUSINESS ENTITY FILINGS AND PUBLICALLY ACCESSIBLE DATABASES?

SYNOPSIS

This non-controversial bill, as proposed to be amended, seeks to address a potential gap in existing law related to the use of a person’s stolen personal identifying information in association with a business entity filing. The bill, which is largely modeled after existing provisions of the California Penal Code related to the criminal use of personal identifying information, enables a person who knows or reasonably suspects that their personal identifying information is being used in association with a business filing without their consent to petition the court for an order requiring that their information be removed from all business filings and publically available databases.

This bill is sponsored by the California Secretary of State who notes that in recent years there have been a handful of cases in which personal identifying information has been stolen and used to form an illegal Limited Liability Company (LLC). The Secretary of State also notes that existing law renders the agency powerless to terminate the LLC’s filing, and that this bill provides victims of this type of identity theft a means to seek redress in the courts. The bill has received unanimous support throughout the year and has no known opposition. Additionally, the bill recently passed the Assembly Committee on Privacy and Consumer Protection on consent.

SUMMARY: Seeking to close a potential gap in existing state law regarding the unlawful use of an individual’s personal identifying information in association with a business entity filing, provides individuals with a process for seeking redress for the unlawful use of their personal identifying information from the court. Specifically, this bill:

1. Defines, for the purpose of the bill, the following terms:
   1. “Business Entity Filing” means a document required by law to be filed with the Secretary of State in accordance with the Corporations Code, Financial Code, or the Insurance Code.
   2. “Personal Identifying Information” means any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver’s license or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother’s maiden name, demand deposit account number, savings account number, checking account number, personal identification number or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification.
   3. “Person” means a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity.
2. Provides that a person who has learned or reasonably suspects that his or her personal identifying information has been used without consent in a business entity filing and has initiated a law enforcement investigation in accordance with the Penal Code, may petition the superior court in the county in which the person resides for an order, which may be granted ex parte, directing the alleged perpetrator of the act, and the person using the personal identifying information in the business entity filing, to appear at a hearing before the court and show cause for both of the following:
   1. Why the personal identifying information should not be labeled to show the information is impersonated and does not reflect the person’s identity.
   2. Why the personal identifying information should be associated with the business entity.
3. Provides that the court shall hear and determine, based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties, whether to grant the petition filed pursuant to 2), above.
4. Provides that if the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court shall make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and shall issue an order certifying this determination.
5. Requires that if the court determines the petition is meritorious, the court shall order the following:
   1. That the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity, and
   2. The data to be removed from publicly accessible electronic indexes and databases.
6. Provides that the court’s determination pursuant to 3), above, may be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.
7. Requires the Judicial Council of California to develop a form for issuing an order based on a detrition pursuant to 3), above.
8. Requires any order issued pursuant to 5), above, shall be filed with the Secretary of State.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
2. Provides that every person who willfully obtains personal identifying information of another person and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, as specified. (Penal Code Section 530.)
3. Provides that a person who has learned or reasonably suspects that their personal identifying information has been unlawfully used by another may initiate a law enforcement investigation, as specified. (Penal Code Section 530.6.)
4. Authorizes the Attorney General to bring an action against any domestic corporation or purported domestic corporation to procure a judgment dissolving the corporation and annulling, vacating or forfeiting its corporate existence upon any of a set of specified grounds, including if the corporation has fraudulently abused or usurped corporate privileges or powers. (Corporations Code Section 1801.)
5. Defines “personal identifying information,” for the purpose of 2) and 3), to mean any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver’s license or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother’s maiden name, demand deposit account number, savings account number, checking account number, personal identification number or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. (Penal Code Section 530.55.)
6. Provides that a person shall not file or record, or direct another to file or record, a lawsuit, lien, or other encumbrance, against another person or entity knowing it is false, with the intent to harass the person or entity or to influence or hinder the person in discharging his or her official duties if the person is a public officer or employee. (Code Civil Procedure Section 765.010 (b).)
7. Authorizes a person or entity whose property is subject to a lien or encumbrance in violation of 6) to petition the superior court of the county in which the person or entity resides or in which the property is located for an order, which may be granted ex parte, directing the lien or other encumbrance claimant to appear at a hearing before the court and show cause why the lien or other encumbrance should not be stricken and why other relief should not be granted. The court shall schedule the hearing no earlier than 14 days after the date of the order. The scheduled date of the hearing shall allow adequate time for notice of the hearing. (Code Civil Procedure Section 765.010 (c).)
8. Provides that if the court determines that the lien or other encumbrance is in violation of 6), the court shall issue an order striking and releasing the lien or other encumbrance and may award costs and reasonable attorney’s fees to the petitioner to be paid by the lien or other encumbrance claimant. (Code of Civil Procedure Section 756.030.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS: Seeking to close a potential gap in California law regarding victims’ rights after their personal identifying information is stolen; this bill seeks to address the instance where illicitly obtained personal identifying information is used to form a business entity, particularly an LLC, in California. In support of this measure, the author states:

SB 1196 closes a gap in state law important for protecting victims of identity theft. While state law allows for victims to seek judicial remedy in cases where false lien filings are made in their name, state law does not similarly authorize victims to seek judicial remedy when stolen personal identifying information is used in public business entity filings. Unauthorized business entity filings create an additional burden on victims of identity theft, by not only obligating them to undergo extra process to reverse damages resulting from use of their stolen identity, but by continuing to make public the victim’s personal information even after other harms from the identity theft are addressed. This bill creates a simple process for these victims to expeditiously seek recourse, restore their identity, and proceed to recover from the intrusion into their privacy.

Identity theft is a significant problem in California. Due to California’s large economy, sizable population, and established technology hubs, California is a particularly ripe target for would-be data thieves. California’s unique data security challenges were highlighted in the Department of Justice’s bi-annual California Data Breach Report released by then-Attorney General Kamala Harris in 2016. (California Department of Justice, California Data Breach Report (Feb. 2016) https://oag.ca.gov/breachreport2016.) That report noted that in the prior four years, 657 unique data breaches occurred in California, impacting over 49 million personal records of Californians. The Attorney General’s report also noted that malware and hacking of systems posed the greatest threat to California’s data security, accounting for 58 percent of all breaches. Perhaps most troubling, the 2016 report indicated that the total incidences of malware and hacking increased 22 percent from the 2014 reporting period. The report also noted that the highly sensitive data, including social security numbers and health records, were the most frequently targeted records by would-be data thieves.

Additionally, The Federal Bureau of Investigation reported that in 2017, California lead the nation in several categories of identity theft, including the number of victims of internet-facilitated frauds, dollar losses, and criminal subjects. (Federal Bureau of Investigation, 2017 Internet Crime Report < https://pdf.ic3.gov/ 2017_IC3Report.pdf>.) This bill’s sponsor, the California Secretary of State’s Office, notes that identity theft poses real harm to victims. Although identity theft is typically associated with attempts to access consumer credit, the Secretary of State’s Office reports stolen identities were allegedly used in the successful creation of eight limited liability corporations in 2015. Existing law provides few tools for the Secretary of State to assist victims of this form of identity theft, as the Secretary of State does not have authority to order the LLC’s termination. Accordingly, this bill seeks to address a potential gap in existing law related to identity theft and business entity formation.

This bill. Seeking to address the existing law’s lack of protections for identity theft victims who have their personal information attached to business filings, this bill seeks to provide these victims a remedy in the courts. The bill would enable a person who learns or reasonably suspects their personal identifying information has been utilized in association with a business entity, and has already reached out to law enforcement seeking an investigation in the matter, to petition the court to require the person utilizing the personal identifying information as a part of a business entity to appear in court. Once in court, the person utilizing the personal information in association with a business must justify why the personal identifying information should continue to be associated with the business entity, and why it should not be marked as an impersonation. If the person utilizing the personal identifying information cannot justify the use of the personal identifying information, the court may issue orders stating that the information is an impersonation and that the data must be removed from all publicly accessible electronic indexes and databases if it reflects the impersonated information. The bill requires all orders to be filed with the Secretary of State, and requires Judicial Council of California to develop the necessary forms to facilitate issuance of the orders.

This well-intentioned measure may be difficult to fully implement. The primary method for providing relief to persons who fall victim to identity theft is the potential reprieve provided by the court’s issuance of an order indicating that their personal identifying information has been used in association with a business entity that is an impersonation, and the issuance of an order to have the information removed from publicly accessible electronic indexes and databases. While enforcement of this bill appears to be relatively simple, at least regarding information maintained by the Secretary of State and other legal information companies that rely on that data, as well as the information maintained by the entity subject to the court order; the complexities of the modern internet make fully removing false information from the internet nearly impossible. Widely utilized search engines like Google offer the ability to search past versioned of cached websites. Although large, publically traded entities like Google are likely to comply with a court order and strive to eliminate access to improperly used personal identifying information, the internet is rife with less-than-reputable search engines, websites, and message boards that are far less likely to adhere to the authority of a court order.

Although this bill may not eliminate all traces of a victim’s personal identifying information being utilized in association with a business entity, it provides a reasonable first step to limit the damage that may be created by the illicit use of a person’s private information in a business filing.

Technical Amendments. As currently in print, this bill makes a reference in the proposed Section 1798.101 of the Civil Code to subdivision (1) of Section 530.5 of the Penal Code. There is no such subdivision in Penal Code Section 530.5. After conversations with the author it has been clarified that this is a simple drafting error. Accordingly, to remedy the issue and clarify the cross-reference in the bill, the author proposed the following amendment:

1798.101.

A person who has learned or reasonably suspects that his or her personal identifying information has been used unlawfully, as described in subdivision (a) of Section 530.5 of the Penal Code, in a business entity filing, and has initiated a law enforcement investigation in accordance with subdivision (a) of Section 530.6 of the Penal Code, may petition the superior court in the county in which the person resides for an order, which may be granted ex parte, directing the alleged perpetrator of the act described in subdivision (c) (1) of Section 530.5 of the Penal Code, if known, and the person using the personal identifying information in the business entity filing to appear at a hearing before the court and show cause for both of the following:

(a) Why the personal identifying information should not be labeled to show the information is impersonated and does not reflect the person’s identity.

(b) Why the personal identifying information should be associated with the business entity.

REGISTERED SUPPORT / OPPOSITION:

Support

California Secretary of State (sponsor)

Opposition

None on file

Analysis Prepared by: Nicholas Liedtke / JUD. / (916) 319-2334

Date of Hearing: June 19, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

SBPCA Bill Id:SB 1196

Author:(Jackson) – As Introduced Ver:February 15, 2018

SENATE VOTE: 39-0

SUBJECT: Personal identifying information: unlawful use: business entity filings

SUMMARY: This bill would allow a person whose personal identifying information (PII) has be used unlawfully in a business filing to petition the court to order the PII redacted or labeled as impersonated and removed from public databases, as specified. Specifically, this bill would:

1. Provide that a person who has learned or reasonably suspects that their PII has been used unlawfully in a business entity filing, and has initiated a law enforcement investigation, may petition the superior court for an order directing the alleged perpetrator of the act and the person using the PII in the business entity filing to appear at a hearing before the court and show cause for both of the following:

• why the PII should not be labeled to show the information is impersonated and does not reflect the person’s identity; and
• why the PII should be associated with the business entity.

1. Require that such a petition be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s PII has been used lawfully in the business entity filing, the court would be required to make a finding that the victim’s PII has been used unlawfully in the business entity filing and issue an order certifying this determination.
2. Provide that upon making such a determination, the court shall do the following:

• order the name and associated PII in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity; and
• order the data to be removed from publicly accessible electronic indexes and databases.

1. Authorize such a determination to be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.
2. Require such orders to be filed with the Secretary of State.
3. Require the Judicial Council of California to develop a form for issuing an order of determination pursuant to these provisions.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
2. Provides that every person who willfully obtains PII of another person and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, as specified. (Pen. Code Sec. 530.5(a).)
3. Provides that a person who has learned or reasonably suspects that their PII has been unlawfully used by another may initiate a law enforcement investigation, as specified. (Pen. Code Sec. 530.6(a).)
4. Authorizes the Attorney General to bring an action against any domestic corporation or purported domestic corporation to procure a judgment dissolving the corporation and annulling, vacating or forfeiting its corporate existence upon any of a set of specified grounds, including if the corporation has fraudulently abused or usurped corporate privileges or powers. (Corp. Code Sec. 1801.)
5. Defines “PII,” for the purpose of specified penal code provisions, to mean any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver’s license or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother’s maiden name, demand deposit account number, savings account number, checking account number, personal identification number or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. (Pen. Code Sec. 530.55.)

FISCAL EFFECT: According to the Senate Appropriations Committee:

• Unknown, potentially-significant cost pressures to the court to adjudicate petitions filed pursuant to this bill and issue the orders. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources. (General Fund*)

The Judicial Council indicates minor and absorbable workload costs related to promulgating the form for issuing an order of determination.

• Unknown costs to the Secretary of State to file orders received by the court.

*Trial Court Trust Fund

COMMENTS:

1. Purpose of the bill: This bill seeks to create a judicial process by which victims, whose stolen PII is used in a public business entity filing, may seek redress. This bill is sponsored by the Secretary of State.
2. Author’s statement: According to the author, “SB 1196 closes a gap in state law important for protecting victims of identity theft. While state law allows for victims to seek judicial remedy in cases where false lien filings are made in their name, state law does not similarly authorize victims to seek judicial remedy when stolen PII is used in public business entity filings. Unauthorized business entity filings create an additional burden on victims of identity theft, by not only obligating them to undergo extra process to reverse damages resulting from use of their stolen identity, but by continuing to make public the victim’s personal information even after other harms from the identity theft are addressed. This bill creates a simple process for these victims to expeditiously seek recourse, restore their identity, and proceed to recover from the intrusion into their privacy.”
3. Identity theft in California: Despite California’s recognition of privacy as a fundamental right in the state constitution, the size of its economy and the sheer number of consumers, make California residents frequent targets by cyber criminals. The Federal Bureau of Investigation reports that in 2017, California topped the list of where each U.S. state ranks in terms of the number of (1) number of victims of internet-facilitated frauds, (2) dollar losses, and (3) criminal subjects. (Federal Bureau of Investigation, 2017 Internet Crime Report < https://pdf.ic3.gov/ 2017_IC3Report.pdf> [as of June 12, 2018].) The California Secretary of State’s Office, sponsor of this bill, further reports that were eight limited liability companies allegedly created as new business entities in 2015 using stolen PII.

To that end, similar to the process provided for victims of fraudulently filed or recorded liens (see Code Civ. Proc. Sec. 765.010), this bill would authorize a person whose PII has been unlawfully used or who reasonably suspects that his or her PII has been unlawfully used in a business entity filing, and who has initiated a law enforcement investigation, to petition the court for an order directing the alleged perpetrator of the act and the person using the PII in the filing to appear and show cause why the information should not be labeled as impersonated and should be associated with the business entity. Such petitions would be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If, based on that evidence, the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s PII has been used lawfully in the business entity filing, the court would be required to make a finding that the victim’s PII has been used unlawfully in the business entity filing and to issue an order certifying that determination on a form to be created by the Judicial Council. This bill would require such an order to be filed with the Secretary of State.

A court would then order the name and associated PII in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity. The court would also be required to order the data to be removed from publicly accessible electronic indexes and databases. If at any time the court finds evidence there was a material misrepresentation in the petition, or that the petition was obtained by fraud, it could vacate an earlier determination that the petition was meritorious.

While there is existing authority for the Attorney General to bring an action to shut down a corporation engaging in fraud and existing authority for courts to grant a victim’s petition to strike a lien or other encumbrance fraudulently filed or recorded, this bill would allow victims whose PII has been unlawfully used in business filings to petition the court based on that business filing alone. Victims would therefore not need to wait for the Attorney General to bring a claim or wait until a lien has been placed on their property before the unauthorized use of their PII could be brought to the court’s attention. Explaining the need for this bill, the author writes, “SB 1196 keeps the full court press on identity thieves by giving state lawmakers a chance to provide victims with a workable solution to a particular form of identity theft used in creating new businesses. Currently, there is no statutory remedy available for a victim of identity theft to remove unauthorized use of their PII from public business entity filings.”

1. Prior legislation:

AB 2043 (Banking and Finance Committee, Ch. 521, Stats. 2006) allows specified business entities that become victims of identity theft to use debt relief protections available to natural persons who are victimized by identity theft.

AB 156 (Murray, Ch. 768, Stats. 1997) made identity theft (i.e., where a person willfully obtains PII of another and uses that information to obtain, or attempt to obtain, credit, goods, or services in the name of the other person without consent) a misdemeanor crime.

1. Double-referral: This bill is double-referred to the Assembly Judiciary Committee, where it will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

Secretary of State (sponsor)

Opposition

None on file

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200

 THIRD READING  

Bill No: SB 1196

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 7-0, 4/24/18

AYES: Jackson, Moorlach, Anderson, Hertzberg, Monning, Stern, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/25/18

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

SUBJECT:

SOURCE: Secretary of State

DIGEST:

This bill authorizes a person whose personal identifying information has been used unlawfully in a business entity filing, as defined, and has initiated a law enforcement investigation, to petition a court for an order directing the alleged perpetrator of the act and the person using the personal identifying information in the filing to appear and show cause as to why the information should not be labeled to show the information is impersonated and should not be associated with the business entity. This bill provides the relevant court process and requires a court that finds the petition meritorious, to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of the personal identifying information from publicly accessible electronic indexes and databases.

ANALYSIS:

Existing law:

1. Provides, through the California Constitution, that all people are by nature free and independent and have inalienable rights, including enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const, Art. I, Sec. 1.)
2. Defines “personal identifying information” for the purpose of specified penal code provisions to mean any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver’s license, or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother’s maiden name, demand deposit account number, savings account number, checking account number, PIN (personal identification number) or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. (Pen. Code Sec. 530.55.)
3. Provides that every person who willfully obtains personal identifying information of another person and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment pursuant to subdivision (h) of Section 1170. (Pen. Code Sec. 530.5(a).)
4. Provides that a person who has learned or reasonably suspects that their personal identifying information has been unlawfully used by another, as described in subdivision (a) of Section 530.5, may initiate a law enforcement investigation by contacting the local law enforcement agency that has jurisdiction over the person’s actual residence or place of business, which shall take a police report of the matter, provide the complainant with a copy of that report, and begin an investigation of the facts. If the suspected crime was committed in a different jurisdiction, the local law enforcement agency may refer the matter to the law enforcement agency where the suspected crime was committed for further investigation of the facts. (Pen. Code Sec. 530.6(a).)
5. States that legally recognized privacy interests are generally of two classes: interests in precluding the dissemination or misuse of sensitive and confidential information (informational privacy), and interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (autonomy privacy). (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 35.)
6. Authorizes the Attorney General to bring an action against any domestic corporation or purported domestic corporation to procure a judgment dissolving the corporation and annulling, vacating or forfeiting its corporate existence upon specified grounds, including if the corporation has fraudulently abused or usurped corporate privileges or powers. (Corp. Code Sec. 1801.)
7. Provides that a person shall not file or record, or direct another to file or record, a lawsuit, lien, or other encumbrance, including a notice of lis pendens, against another person or entity knowing it is false, with the intent to harass the person or entity or to influence or hinder the person in discharging his or her official duties if the person is a public officer or employee. (Code Civ. Proc. Sec. 765.010(b).)
8. Authorizes a person or entity whose property is subject to a lien or encumbrance in violation of the above provision to petition the superior court of the county in which the person or entity resides or in which the property is located for an order, which may be granted ex parte, directing the lien or other encumbrance claimant to appear at a hearing before the court and show cause why the lien or other encumbrance should not be stricken and why other relief should not be granted. The court shall schedule the hearing no earlier than 14 days after the date of the order. The scheduled date of the hearing shall allow adequate time for notice of the hearing. (Code Civ. Proc. Sec. 765.010(c).) The petition shall state the grounds upon which relief is requested, and shall be supported by the affidavit of the petitioner or the petitioner’s attorney setting forth a concise statement of the facts upon which the motion is based. The petition and affidavit shall be in substantially the form prescribed by the Judicial Council. (Code Civ. Proc. Sec. 765.020.)
9. Provides that if the court determines that the lien or other encumbrance is in violation of Section 765.010, the court shall issue an order striking and releasing the lien or other encumbrance and may award costs and reasonable attorney’s fees to the petitioner to be paid by the lien or other encumbrance claimant. If the court determines that the lien or other encumbrance is valid, the court shall issue an order so stating and may award costs and reasonable attorney’s fees to the encumbrance claimant to be paid by the petitioner. The court may direct that an order issued pursuant to this section be recorded. (Code Civ. Proc. Sec. 765.030.) A claimant to be found in violation shall be liable to the person subject to the lawsuit or the owner of the property bound by the lien or other encumbrance for a civil penalty of up to $5,000. (Code Civ. Proc. Sec. 765.040.)

This bill:

1. Defines “business entity filing” as a document required by law to be filed with the Secretary of State pursuant to the Corporations Code, the Financial Code, or the Insurance Code. “Personal identifying information” has the same meaning as in Section 530.55 of the Penal Code. “Person” is defined as a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity.
2. Provides that a person who has learned or reasonably suspects that their personal identifying information has been used unlawfully in a business entity filing and has initiated a law enforcement investigation may petition the court for an order, which may be granted ex parte, directing the alleged perpetrator of the act, if known, and the person using the personal identifying information in the business entity filing to appear at a hearing before the court and show cause for why the personal identifying information should not be labeled to show the information is impersonated and does not reflect the person’s identity; and why the personal identifying information should be associated with the business entity.
3. Requires that such a petition be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court is required to make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and shall issue an order certifying this determination.
4. Authorizes such a determination to be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.
5. Provides that upon making such a determination, the court must:
   1. order the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity; and
   2. order the data to be removed from publicly accessible electronic indexes and databases.
6. Requires such orders to be filed with the Secretary of State.
7. Requires the Judicial Council of California to develop a form for issuing an order of determination pursuant to this section.

Background

According to the Federal Trade Commission’s (FTC) “Consumer Sentinel Network Data Book 2017,” California had more identity theft complaints—55,418—than any other state. For every 100,000 people in California, there were 140 identity theft complaints. (FTC, Consumer Sentinel Network Data Book 2017 (Mar. 2018) <https://www.ftc.gov/policy/reports/policy-reports/commission-staff-reports/ consumer-sentinel-network-data-book-2017/state-rankings-id-theft-reports [as of Apr. 5, 2018].)

Identity theft victims’ information can be misused in numerous ways. One of the most common is the creation of new accounts, including credit card, utility, or wireless telephone accounts. But, victims’ information can also be used in other, equally nefarious ways. As the FTC notes:

Once identity thieves have your personal information, they can drain your bank account, run up charges on your credit cards, open new utility accounts, or get medical treatment on your health insurance. An identity thief might even file a tax return in your name and get your refund. In some extreme cases, a thief might even give your name to the police during an arrest.

(FTC, Warning Signs of Identity Theft < https://www.consumer.ftc.gov/articles/ 0271-warning-signs-identity-theft [as of Apr. 11, 2018].)

This bill responds to one particular use of unlawfully obtained personal identifying information: business entity filings. Identity thieves have utilized the personal identifying information of others in order to create new businesses and for other business entity filings. This bill provides a process for a victim of such identity theft to petition a court for an order to redact such information or label it to show it has been impersonated, and to order the data be removed from publicly accessible electronic indexes and databases.

Comments

The author states:

SB 1196 closes a gap in state law important for protecting victims of identity theft. While state law allows for victims to seek judicial remedy in cases where false lien filings are made in their name, state law does not similarly authorize victims to seek judicial remedy when stolen personal identifying information is used in public business entity filings. Unauthorized business entity filings create an additional burden on victims of identity theft, by not only obligating them to undergo extra process to reverse damages resulting from use of their stolen identity, but by continuing to make public the victim’s personal information even after other harms from the identity theft are addressed. This bill creates a simple process for these victims to expeditiously seek recourse, restore their identity, and proceed to recover from the intrusion into their privacy.

Providing another tool for victims of identity theft

California recognizes that the right to privacy is a fundamental right, and has enshrined that right along with other fundamental rights in Article I, Section 1 of the California Constitution.

Unfortunately, because of the size of its economy and the sheer number of consumers, California is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that, in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.”

Over the four-year period from 2012 to 2015, the Attorney General received reports on over 657 breaches, affecting over 49 million records. In 2015 alone, nearly three in five Californians were victims of a data breach. These data breaches are not harmless. The Attorney General reports that in 2014, 67 percent of breach victims in the United States were also victims of fraud.

According to the Secretary of State’s Office, there were reports of eight limited liability companies that were allegedly created as new business entities in 2015, using stolen personal identifying information. However, there is no specific statute authorizing courts to dissolve limited liability companies fraudulently created. While there is authority for the Attorney General to bring an action to shut down a corporation engaging in fraud and authority for courts to grant a victim’s petition to strike a lien or other encumbrance fraudulently filed or recorded, there is no corresponding authority for other business entity filings. The Secretary of State argues that they are not an enforcement agency but simply a filing office that does not have the authority to remove these fraudulent filings without statutory approval.

This bill responds to this gap in the law by authorizing a person whose personal identifying information has been used unlawfully in a business entity filing and who has initiated a law enforcement investigation, to petition the court for an order directing the alleged perpetrator of the act and the person using the personal identifying information in the filing to appear and show cause why the information should not be labeled as impersonated and should not be associated with the business entity.

This bill details the relevant court process, which largely tracks the process provided for victims of fraudulently filed or recorded liens and encumbrances. (See Code Civ. Proc. Sec. 765.010.) Such petitions are heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If, based on that evidence, the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court is required to make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and to issue an order certifying that determination on a form to be created by the Judicial Council. This bill requires such an order to be filed with the Secretary of State.

A court then orders the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity. The court is also required to order the data to be removed from publicly accessible electronic indexes and databases. If at any time the court finds evidence there was a material misrepresentation in the petition, or that the petition was obtained by fraud, it could vacate an earlier determination that the petition was meritorious.

By affording victims of this manner of identity theft an opportunity to disassociate their names from such fraudulent businesses and filings, this bill adds an additional avenue for consumers to protect their identities and their fundamental right to privacy.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee:

• Unknown, potentially-significant cost pressures to the court to adjudicate petitions filed pursuant to this bill and issue the orders. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources. (General Fund*)

The Judicial Council indicates minor and absorbable workload costs related to promulgating the form for issuing an order of determination.

• Unknown costs to the Secretary of State to file orders received by the court.

*Trial Court Trust Fund

SUPPORT: (Verified 5/25/18)

Secretary of State (source)

OPPOSITION: (Verified 5/25/18)

None received

Prepared by:

5/26/18 15:26:22

**** END ****

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2017 - 2018 Regular Session

SB 1196 (Jackson) - Personal identifying information: unlawful use: business entity filings

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

SB 1196 would allow a person, as defined, whose personal identifying information (PII) has be used unlawfully to petition the court to order the PII in business filings redacted or labeled as impersonated and removed from public databases, as specified.

Fiscal Impact:

• Unknown, potentially-significant cost pressures to the court to adjudicate petitions filed pursuant to this bill and issue the orders. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources. (General Fund*)

The Judicial Council indicates minor and absorbable workload costs related to promulgating the form for issuing an order of determination.

• Unknown costs to the Secretary of State to file orders received by the court.

*Trial Court Trust Fund

Background:

Existing law defines PII as any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver’s license, or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother’s maiden name, demand deposit account number, savings account number, checking account number, PIN or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprint, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. It is a crime to willfully obtain PII of another person and use that information for an unlawful purpose, including obtaining, or attempting to obtain, credit, goods, services, real property, or medical information without the consent of the person who is the subject of the information. Punishment for this crime start at a misdemeanor with imprisonment of up to one year in county jail and/or a fine and increases depending on associated circumstances (e.g., if the information is sold or transferred). A person who learns or reasonably suspects that his or her PII has been used by another to commit a crime may initiate a law enforcement investigation by contacting the local law enforcement agency, and the agency must take a police report of the matter and provide the complainant with a copy of that report.

Proposed Law:

This bill would:

• Allow a person who has learned that his or her PII has been used unlawfully in a business entity filing, as defined, and has obtained the police report to petition a court for a determination of unlawful use of his or her PII in the filling.
• Require the court, upon making a determination that the petitioner’s PII has been used unlawfully, to order the name and PII in the business entity filing redacted or labeled to show the data is impersonated and to order the removal of the PII from publicly accessible electronic indexes and databases.
• Require the Judicial Council to develop a form for issuing that order
• Require the order be filed with the Secretary of State.
• Define “person” as a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity.

Related Legislation:

AB 2043 (Banking and Finance Committee, Ch. 521, Stats. 2006) allows specified business entities that become victims of identity theft to use debt relief protections available to natural persons who are victimized by identity theft.

AB 156 (Murray, Ch. 768, Stats. 1997) made identity theft (i.e., where a person willfully obtains PII of another and uses that information to obtain, or attempt to obtain, credit, goods, or services in the name of the other person without consent) a misdemeanor crime

Staff Comments:

The fiscal impact of this bill will depend on how many business filings contain unlawfully used PII, if the person whose PII was used unlawfully obtains a police report, and the factors unique to each case. While it is unknown how many petitions would be filed ultimately, it costs the court $7,010 in personnel and resources to operate a courtroom for one day. This cost takes into consideration the time from when a petition or motion is received by the court, processing and calendaring by the clerks, any hearings presided over by a judicial officer, and the finalizing of the outcome by the clerk. If the relief that would be created by SB 1196 took an average of three hour per case for the court to adjudicate—from receiving the filing, calendaring, reviewing the petition, holding a hearing, and issuing an order—for more than nineteen new petitions, the cost pressures of this bill to the court would surpass the Suspense File threshold. As indicated in the analysis of this bill by the Senate Committee on Judiciary, there were 140 identity theft complaints for every 100,000 people in California. It also indicated that in 2015 there were eight limited liability companies (LLCs) known of that were created as new business entities allegedly using stolen PII. In addition to LLCs, this bill would cover other types of business filings filed with the Secretary of State, such as corporations and limited partnerships. It is unknown how many stolen PII were used to establish these other types of business entities or if the full scope of allegedly false LLC filings, but it appears that the underlying act of using another person’s PII without consent is not uncommon.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2017-2018 Regular Session

Bill No: SB 1196 (Author:Jackson)

Version: February 15, 2018

Hearing Date: April 24, 2018

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Personal identifying information: unlawful use: business entity filings

DESCRIPTION

This bill would authorize a person whose personal identifying information has been used unlawfully in a business entity filing, as defined, and has initiated a law enforcement investigation, to petition a court for an order directing the alleged perpetrator of the act and the person using the personal identifying information in the filing to appear and show cause as to why the information should not be labeled to show the information is impersonated and should not be associated with the business entity. This bill would provide the relevant court process and would require a court that finds the petition meritorious, to order that the name and personal identifying information in the business entity filing be redacted or labeled to show the data is impersonated and to order the removal of the personal identifying information from publicly accessible electronic indexes and databases.

BACKGROUND

According to the Federal Trade Commission’s (FTC) “Consumer Sentinel Network Data Book 2017,” California had more identity theft complaints—55,418—than any other state. For every 100,000 people in California, there were 140 identity theft complaints. (Federal Trade Commission, Consumer Sentinel Network Data Book 2017 (Mar. 2018) <https://www.ftc.gov/policy/reports/policy-reports/commission-staff-reports/consumer-sentinel-network-data-book-2017/state-rankings-id-theft-reports> [as of Apr. 5, 2018].)

Identity theft victims’ information can be misused in numerous ways. One of the most common is the creation of new accounts, including credit card, utility, or wireless telephone accounts. But, victims’ information can also be used in other, equally nefarious ways. As the Federal Trade Commission notes:

Once identity thieves have your personal information, they can drain your bank account, run up charges on your credit cards, open new utility accounts, or get medical treatment on your health insurance. An identity thief might even file a tax return in your name and get your refund. In some extreme cases, a thief might even give your name to the police during an arrest.

(Federal Trade Commission, Warning Signs of Identity Theft < https://www.consumer. ftc.gov/articles/0271-warning-signs-identity-theft > [as of Apr. 11, 2018].)

This bill would respond to one particular use of unlawfully obtained personal identifying information: business entity filings. Identity thieves have utilized the personal identifying information of others in order to create new businesses and for other business entity filings. This bill would provide a process for a victim of such identity theft to petition a court for an order to redact such information or label it to show it has been impersonated, and to order the data be removed from publicly accessible electronic indexes and databases.

CHANGES TO EXISTING LAW

Existing law, the California Constitution, provides that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const, art. I, Sec. 1.)

Existing law defines “personal identifying information” for the purpose of specified penal code provisions to mean any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver’s license, or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother’s maiden name, demand deposit account number, savings account number, checking account number, PIN (personal identification number) or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprints, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. (Pen. Code Sec. 530.55.)

Existing law provides that every person who willfully obtains personal identifying information of another person and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment pursuant to subdivision (h) of Section 1170. (Pen. Code Sec. 530.5(a).)

Existing law provides that a person who has learned or reasonably suspects that their personal identifying information has been unlawfully used by another, as described in subdivision (a) of Section 530.5, may initiate a law enforcement investigation by contacting the local law enforcement agency that has jurisdiction over the person’s actual residence or place of business, which shall take a police report of the matter, provide the complainant with a copy of that report, and begin an investigation of the facts. If the suspected crime was committed in a different jurisdiction, the local law enforcement agency may refer the matter to the law enforcement agency where the suspected crime was committed for further investigation of the facts. (Pen. Code Sec. 530.6(a).)

Existing case law states that legally recognized privacy interests are generally of two classes: interests in precluding the dissemination or misuse of sensitive and confidential information (informational privacy), and interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (autonomy privacy). (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 35.)

Existing law authorizes the Attorney General to bring an action against any domestic corporation or purported domestic corporation to procure a judgment dissolving the corporation and annulling, vacating or forfeiting its corporate existence upon any of a set of specified grounds, including if the corporation has fraudulently abused or usurped corporate privileges or powers. (Corp. Code Sec. 1801.)

Existing law provides that a person shall not file or record, or direct another to file or record, a lawsuit, lien, or other encumbrance, including a notice of lis pendens, against another person or entity knowing it is false, with the intent to harass the person or entity or to influence or hinder the person in discharging his or her official duties if the person is a public officer or employee. (Code Civ. Proc. Sec. 765.010(b).)

Existing law authorizes a person or entity whose property is subject to a lien or encumbrance in violation of the above provision to petition the superior court of the county in which the person or entity resides or in which the property is located for an order, which may be granted ex parte, directing the lien or other encumbrance claimant to appear at a hearing before the court and show cause why the lien or other encumbrance should not be stricken and why other relief should not be granted. The court shall schedule the hearing no earlier than 14 days after the date of the order. The scheduled date of the hearing shall allow adequate time for notice of the hearing. (Code Civ. Proc. Sec. 765.010(c).) The petition shall state the grounds upon which relief is requested, and shall be supported by the affidavit of the petitioner or the petitioner’s attorney setting forth a concise statement of the facts upon which the motion is based.

The petition and affidavit shall be in substantially the form prescribed by the Judicial Council. (Code Civ. Proc. Sec. 765.020.)

Existing law provides that if the court determines that the lien or other encumbrance is in violation of Section 765.010, the court shall issue an order striking and releasing the lien or other encumbrance and may award costs and reasonable attorney’s fees to the petitioner to be paid by the lien or other encumbrance claimant. If the court determines that the lien or other encumbrance is valid, the court shall issue an order so stating and may award costs and reasonable attorney’s fees to the encumbrance claimant to be paid by the petitioner. The court may direct that an order issued pursuant to this section be recorded. (Code Civ. Proc. Sec. 765.030.) A claimant to be found in violation shall be liable to the person subject to the lawsuit or the owner of the property bound by the lien or other encumbrance for a civil penalty of up to $5,000. (Code Civ. Proc. Sec. 765.040.)

This bill would define “business entity filing” as a document required by law to be filed with the Secretary of State pursuant to the Corporations Code, the Financial Code, or the Insurance Code. “Personal identifying information” would have the same meaning as defined in subdivision (b) of Section 530.55 of the Penal Code. “Person” would be defined as a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity.

This bill would provide that a person who has learned or reasonably suspects that their personal identifying information has been used unlawfully, as described in subdivision (a) of Section 530.5 of the Penal Code, in a business entity filing, and has initiated a law enforcement investigation in accordance with subdivision (a) of Section 530.6 of the Penal Code, may petition the superior court in the county in which the person resides for an order, which may be granted ex parte, directing the alleged perpetrator of the act described in subdivision (1) of Section 530.5 of the Penal Code, if known, and the person using the personal identifying information in the business entity filing to appear at a hearing before the court and show cause for both of the following:

• why the personal identifying information should not be labeled to show the information is impersonated and does not reflect the person’s identity; and
• why the personal identifying information should be associated with the business entity.

This bill would require that such a petition be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court would be required to make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and shall issue an order certifying this determination.

This bill would authorize such a determination to be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.

This bill would provide that upon making such a determination, the court shall do the following:

• order the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity; and
• order the data to be removed from publicly accessible electronic indexes and databases.

This bill would require such orders to be filed with the Secretary of State.

This bill would require the Judicial Council of California to develop a form for issuing an order of determination pursuant to this section.

COMMENT

1. Stated need for the bill

According to the author:

SB 1196 closes a gap in state law important for protecting victims of identity theft. While state law allows for victims to seek judicial remedy in cases where false lien filings are made in their name, state law does not similarly authorize victims to seek judicial remedy when stolen personal identifying information is used in public business entity filings. Unauthorized business entity filings create an additional burden on victims of identity theft, by not only obligating them to undergo extra process to reverse damages resulting from use of their stolen identity, but by continuing to make public the victim’s personal information even after other harms from the identity theft are addressed. This bill creates a simple process for these victims to expeditiously seek recourse, restore their identity, and proceed to recover from the intrusion into their privacy.

2. Providing another tool for victims of identity theft

California recognizes that the right to privacy is a fundamental right, and has enshrined that right along with other fundamental rights in article I, section 1 of the California Constitution.

Unfortunately, because of the size of its economy and the sheer number of consumers, California is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that, in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.” (California Department of Justice, California Data Breach Report (Oct. 2014) <https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy /2014data_breach_rpt.pdf> [as of Apr. 11, 2018].)

Over the four-year period from 2012 to 2015, the Attorney General received reports on over 657 breaches, affecting over 49 million records. (California Department of Justice, California Data Breach Report (Feb. 2016) <https://oag.ca.gov/breachreport2016> [as of Apr. 11, 2018].) In 2015 alone, nearly three in five Californians were victims of a data breach. These data breaches are not harmless. The Attorney General reports that in 2014, 67 percent of breach victims in the United States were also victims of fraud.

According to the Secretary of State’s Office, there were reports of eight limited liability companies that were allegedly created as new business entities in 2015, using stolen personal identifying information. However, there is no specific statute authorizing courts to dissolve limited liability companies fraudulently created. While there is authority for the Attorney General to bring an action to shut down a corporation engaging in fraud and authority for courts to grant a victim’s petition to strike a lien or other encumbrance fraudulently filed or recorded, there is no corresponding authority for other business entity filings. The Secretary of State argues that they are not an enforcement agency but simply a filing office that does not have the authority to remove these fraudulent filings without statutory approval.

This bill would respond to this gap in the law by authorizing a person whose personal identifying information has been used unlawfully in a business entity filing and who has initiated a law enforcement investigation, to petition the court for an order directing the alleged perpetrator of the act and the person using the personal identifying information in the filing to appear and show cause why the information should not be labeled as impersonated and should not be associated with the business entity.

The bill details the relevant court process, which would largely track the process provided for victims of fraudulently filed or recorded liens and encumbrances. (See Code Civ. Proc. Sec. 765.010.) Such petitions would be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court. If, based on that evidence, the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court would be required to make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and to issue an order certifying that determination on a form to be created by the Judicial Council. This bill would require such an order to be filed with the Secretary of State.

A court would then order the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity. The court would also be required to order the data to be removed from publicly accessible electronic indexes and databases. If at any time the court finds evidence there was a material misrepresentation in the petition, or that the petition was obtained by fraud, it could vacate an earlier determination that the petition was meritorious.

By affording victims of this manner of identity theft an opportunity to disassociate their names from such fraudulent businesses and filings, this bill would add an additional avenue for consumers to protect their identities and their fundamental right to privacy.

Support: None Known

Opposition: None Known

HISTORY

Source: Secretary of State

Related Pending Legislation:

SB 823 (Hill, 2018) would provide consumers a more expedient and accessible process for placing a security freeze on their credit report by, in part, prohibiting fees for placing, temporarily lifting, replacing, or removing such freezes; requiring prominent links be provided by the agencies for quick, electronic control over these actions; shortening the time line for these actions; and requiring agencies to ensure these actions are also taken with other agencies when the consumer so elects. This bill is currently on the Senate Floor.

SB 1121 (Dodd, 2018) would replace the term “customer” as used in Sections 1798.80 through 1798.84 of the Civil Code, the California Customer Records Act, with the term “consumer.” It would also provide any consumer whose personal information has been or is reasonably believed to have been breached by a violation of Section 1798.81.5 or 1798.82 with the right to institute a civil action for the recovery of statutory damages, injunctive or declaratory relief, and any other relief the court deems proper. This bill is currently in the Senate Judiciary Committee.

AB 608 (Irwin, 2017) would prohibit consumer credit reporting agencies from charging fees in connection with placing or removing security freezes for protected consumers, defined as individuals who are under 16, incapacitated, or under a county welfare or county probation department’s jurisdiction. This bill is currently in the Senate Judiciary Committee.

AB 1859 (Chau, 2018) would require a consumer credit reporting agency that knows of a vulnerability that could compromise the security of personal information for which there is an update to address, to apply that update or be held liable for any resulting damages. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 2678 (Irwin, 2018) would require the notification provided to a person affected by a breach, if the breach exposed or may have exposed specified personal information, to include, among other things, notice that the affected person may elect to place a security freeze on his or her credit report and an explanation of how a security freeze differs from identity theft prevention and mitigation services. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

Prior Legislation:

AB 2043 (Banking and Finance Committee, Ch. 521, Stats. 2006) authorized specified business entities that become the victims of identity theft to utilize debt relief protections available to natural persons who are victimized by identity theft.

AB 156 (Murray, Ch. 768, Stats. 1997) formally recognized identity theft as a crime, providing that it is a misdemeanor for a person to willfully obtain personal identifying information of another and use that information to obtain, or attempt to obtain, credit, goods, or services in the name of another person without the consent of that person.

**************