SB 1001: California Cybersecurity Integration Center: consumer protection: credit reporting.
- Session Year: 2021-2022
- House: Senate
- Latest Version Date: 2022-09-09
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would require the center, by December 31, 2024, to submit to the Legislature, as specified, a report on the feasibility of, and the potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, including requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed, and specified tactics related to using alternatives to social security numbers as authenticators.
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would require the center, by December 31, 2023, 2024, to submit to the Legislature, as specified, a report on the feasibility of, and the potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, including requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed, and specified tactics related to using alternatives to social security numbers as authenticators.
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would require the center, by December 31, 2023, to submit to the Legislature, as specified, a report on the feasibility of, and benefits of the potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, including requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed, and specified tactics related to using alternatives to social security numbers as authenticators.
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would require the center, by December 31, 2023, to submit to the Legislature, as specified, a report on the feasibility and benefits of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, including requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed, and specified tactics related to using alternatives to social security numbers as authenticators.
Existing law requires the Department of Justice to establish and maintain a database of individuals who have been victims of identity theft and to provide a victim of identity theft, or their authorized representative, access to the database in order to establish that the individual has been a victim of identity theft.This bill would make technical, nonsubstantive changes to that provision.Existing law requires the Department of Justice to establish and maintain a database of individuals who have been victims of identity theft and to provide a victim of identity theft, or their authorized representative, access to the database in order to establish that the individual has been a victim of identity theft.
This bill would make technical, nonsubstantive changes to that provision.
(a)On or before December 31, 2024, the California Cybersecurity Integration Center shall submit to the Legislature a report on the feasibility of, and the potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud. The report shall include, but not be limited to, an assessment of the feasibility of, and the potential benefits, risks, and costs of, utilizing all of the following tactics:
(1)Requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed.
(2)Utilization of statewide alternatives to social security numbers as authenticators in determining an individuals identity.
(3)Requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individuals identity.
(b)(1)A report to be submitted pursuant to subdivision (a) shall be submitted in compliance with Section 9795.
(2)Pursuant to Section 10231.5, this section is repealed on January 1, 2027.
(a)On or before December 31, 2023, 2024, the California Cybersecurity Integration Center shall submit to the Legislature a report on the feasibility of, and the potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud. The report shall include, but not be limited to, an assessment of the feasibility of, and the potential benefits, risks, and costs of, utilizing all of the following tactics:
(1)Requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed.
(2)Utilization of statewide alternatives to social security numbers as authenticators in determining an individuals identity.
(3)Requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individuals identity.
(b)(1)A report to be submitted pursuant to subdivision (a) shall be submitted in compliance with Section 9795.
(2)Pursuant to Section 10231.5, this section is repealed on January 1, 2027.
(a)On or before December 31, 2023, the California Cybersecurity Integration Center shall submit to the Legislature a report on the feasibility of, and benefits of the potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud. The report shall include, but not be limited to, an assessment of the feasibility of, and benefits of the potential benefits, risks, and costs of, utilizing all of the following tactics:
(1)Requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed.
(2)Utilization of statewide alternatives to social security numbers as authenticators in determining an individuals identity, including a Social Security Number Plus (SSN+), a mobile drivers license, or other proposals that may be promising. identity.
(3)Requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individuals identity.
(b)(1)A report to be submitted pursuant to subdivision (a) shall be submitted in compliance with Section 9795.
(2)Pursuant to Section 10231.5, this section is repealed on January 1, 2027.
(a)On or before December 31, 2023, the California Cybersecurity Integration Center shall submit to the Legislature a report on the feasibility and benefits of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud. The report shall include, but not be limited to, an assessment of the feasibility and benefits of utilizing all of the following tactics:
(1)Requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed.
(2)Utilization of statewide alternatives to social security numbers as authenticators in determining an individuals identity, including a Social Security Number Plus (SSN+), a mobile drivers license, or other proposals that may be promising.
(3)Requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individuals identity.
(b)(1)A report to be submitted pursuant to subdivision (a) shall be submitted in compliance with Section 9795.
(2)Pursuant to Section 10231.5, this section is repealed on January 1, 2027.
SECTION 1.Section 530.7 of the Penal Code is amended to read:530.7.(a)In order for a victim of identity theft to be included in the database established pursuant to subdivision (c), they shall submit to the Department of Justice a court order obtained pursuant to any law, a full set of fingerprints, and any other information prescribed by the department.(b)Upon receiving information pursuant to subdivision (a), the Department of Justice shall verify the identity of the victim against any drivers license or other identification record maintained by the Department of Motor Vehicles.(c)The Department of Justice shall establish and maintain a database of individuals who have been victims of identity theft. The department shall provide a victim of identity theft or their authorized representative access to the database in order to establish that the individual has been a victim of identity theft. Access to the database shall be limited to criminal justice agencies, victims of identity theft, and individuals and agencies authorized by the victims.(d)The Department of Justice shall establish and maintain a toll-free telephone number to provide access to information under subdivision (c).(a)In order for a victim of identity theft to be included in the data base database established pursuant to subdivision (c), he or she they shall submit to the Department of Justice a court order obtained pursuant to any provision of law, a full set of fingerprints, and any other information prescribed by the department.
(b)Upon receiving information pursuant to subdivision (a), the Department of Justice shall verify the identity of the victim against any drivers license or other identification record maintained by the Department of Motor Vehicles.
(c)The Department of Justice shall establish and maintain a data base database of individuals who have been victims of identity theft. The department shall provide a victim of identity theft or his or her their authorized representative access to the data base database in order to establish that the individual has been a victim of identity theft. Access to the data base database shall be limited to criminal justice agencies, victims of identity theft, and individuals and agencies authorized by the victims.
(d)The Department of Justice shall establish and maintain a toll-free telephone number to provide access to information under subdivision (c).
(e)This section shall be operative September 1, 2001.|
Date
|
Status
|
|---|---|
| Sep 23, 2022 | In Senate. Consideration of Governor's veto pending. |
| Sep 23, 2022 | Vetoed by the Governor. |
| Sep 13, 2022 | Enrolled and presented to the Governor at 3 p.m. |
| Aug 31, 2022 | Assembly amendments concurred in. (Ayes 40. Noes 0. Page 5415.) Ordered to engrossing and enrolling. |
| Aug 31, 2022 | In Senate. Concurrence in Assembly amendments pending. |
| Aug 31, 2022 | Read third time. Passed. Ordered to the Senate. |
| Aug 22, 2022 | Read third time and amended. |
| Aug 16, 2022 | Read second time. Ordered to third reading. |
| Aug 15, 2022 | Read second time and amended. Ordered to second reading. |
| Aug 11, 2022 | From committee: Do pass as amended. (Ayes 12. Noes 0.) (August 11). |
| Jun 29, 2022 | June 29 set for first hearing. Placed on suspense file. |
| Jun 14, 2022 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 9. Noes 0.) (June 14). Re-referred to Com. on APPR. |
| Jun 2, 2022 | Referred to Com. on P. & C.P. |
| May 26, 2022 | In Assembly. Read first time. Held at Desk. |
| May 25, 2022 | Read third time. Passed. (Ayes 39. Noes 0. Page 3932.) Ordered to the Assembly. |
| May 23, 2022 | Ordered to special consent calendar. |
| May 19, 2022 | From committee: Do pass. (Ayes 7. Noes 0. Page 3779.) (May 19). |
| May 13, 2022 | Set for hearing May 19. |
| May 9, 2022 | May 9 hearing: Placed on APPR suspense file. |
| Apr 29, 2022 | Set for hearing May 9. |
| Apr 27, 2022 | From committee: Do pass and re-refer to Com. on APPR with recommendation: To consent calendar. (Ayes 11. Noes 0. Page 3513.) (April 26). Re-referred to Com. on APPR. |
| Apr 7, 2022 | Set for hearing April 26. |
| Apr 5, 2022 | From committee: Do pass and re-refer to Com. on JUD. (Ayes 11. Noes 0. Page 3324.) (April 5). Re-referred to Com. on JUD. |
| Mar 29, 2022 | Set for hearing April 5. |
| Mar 23, 2022 | Re-referred to Coms. on G.O. and JUD. |
| Mar 16, 2022 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on RLS. |
| Feb 23, 2022 | Referred to Com. on RLS. |
| Feb 15, 2022 | From printer. |
| Feb 14, 2022 | Introduced. Read first time. To Com. on RLS. for assignment. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 31, 2022 | SB 1001 Min Senate Third Reading By Petrie-Norris | Assembly Floor |
Passed |
|
| Aug 31, 2022 | Unfinished Business SB1001 Min Concurrence | Senate Floor |
Passed |
|
| May 25, 2022 | Special Consent SB1001 | Senate Floor |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
Bill Author
Bill Co-Author(s):