California Senate Bill SB909 Amended / Bill

 BILL NUMBER: SB 909AMENDED BILL TEXT AMENDED IN SENATE MAY 12, 2010 AMENDED IN SENATE MARCH 8, 2010 INTRODUCED BY Senator Wright JANUARY 27, 2010 An act to amend Sections 1786.16 and 1786.20 of the Civil Code, relating to personal information. LEGISLATIVE COUNSEL'S DIGEST SB 909, as amended, Wright. Investigative consumer reporting agencies: disclosures. Existing law requires a person who procures or causes to be prepared an investigative consumer report for employment purposes other than suspicion of wrongdoing to meet specified conditions, including, but not limited to, the name and address of the agency conducting the investigation, the nature and scope of the investigation, and information on consumer inspection. This bill would additionally require a person who procures or causes to be prepared an investigative consumer report for employment purposes to provide a consumer with a Disclosure and Request for Consent for the Information to be Sent Outside of the United States or its Territories, as specified, if that person knows or should know that any part of an investigative consumer report will be prepared or processed outside the United States. Existing law requires investigative consumer reporting agencies to establish reasonable procedures to ensure that specified, prohibited items of information concerning consumers are not part of the reports they furnish. Existing law generally provides that an investigative consumer reporting agency or user of information that fails to comply with any requirement under these provisions with respect to an investigative consumer report is liable to the consumer who is the subject of the report for the sum of the greater of actual damages or $10,000, the costs of the action, reasonable attorney's fees, and, in certain cases, punitive damages, as specified. This bill would additionally require an investigative consumer reporting agency that prepares or processes in any manner an investigative consumer report, or portion thereof, outside of the United States or its territories to make specified disclosures to the potential user of this information, including, but not limited to, the country or countries where the report, or portion thereof, will be prepared or processed. The bill would also prohibit an investigative consumer reporting agency from transmitting a consumer' s social security number, except for the last 4 digits, outside of the United States or its territories. The bill would require these agencies to adopt and  publish   conspicuously post  a privacy policy relating to information contained in reports that are prepared or processed outside of the United States, as specified. The bill would provide that an investigative consumer reporting agency is liable to a consumer who is harmed by any act or omission that occurs outside the United States or its territories, as specified. This bill would exempt a person who procures or causes to be prepared an investigative consumer report and an investigative consumer reporting agency from these requirements if the requested information pertains or relates to matters that occurred outside of the United States or its territories,  or  was stored, processed, or prepared outside of the United States or its territories prior to date the report was requested  , or was sent outside the United States or its territories solely for the purpose of transmitting or storing data  . Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 1786.16 of the Civil Code is amended to read: 1786.16. (a) Any person described in subdivision (d) of Section 1786.12 shall not procure or cause to be prepared an investigative consumer report unless the following applicable conditions are met: (1) If an investigative consumer report is sought in connection with the underwriting of insurance, it shall be clearly and accurately disclosed in writing at the time the application form, medical form, binder, or similar document is signed by the consumer that an investigative consumer report regarding the consumer's character, general reputation, personal characteristics, and mode of living may be made. If no signed application form, medical form, binder, or similar document is involved in the underwriting transaction, the disclosure shall be made to the consumer in writing and mailed or otherwise delivered to the consumer not later than three days after the report was first requested. The disclosure shall include the name and address of any investigative consumer reporting agency conducting an investigation, plus the nature and scope of the investigation requested, and a summary of the provisions of Section 1786.22. (2) If, at any time, an investigative consumer report is sought for employment purposes other than suspicion of wrongdoing or misconduct by the subject of the investigation, the person seeking the investigative consumer report may procure the report, or cause the report to be made, only if all of the following apply: (A) The person procuring or causing the report to be made has a permissible purpose, as defined in Section 1786.12. (B) The person procuring or causing the report to be made provides a clear and conspicuous disclosure in writing to the consumer at any time before the report is procured or caused to be made in a document that consists solely of the disclosure, that: (i) An investigative consumer report may be obtained. (ii) The permissible purpose of the report is identified. (iii) The disclosure may include information on the consumer's character, general reputation, personal characteristics, and mode of living. (iv) Identifies the name, address, and telephone number of the investigative consumer reporting agency conducting the investigation. (v) Notifies the consumer in writing of the nature and scope of the investigation requested, including a summary of the provisions of Section 1786.22. (C) (i) If the person procuring or causing the report to be made knows, or in the exercise of reasonable care should know, that any part of an investigative consumer report is to be prepared or processed outside the United States or its territories, that person provides a Disclosure and Request for Consent for the Information to be Sent Outside of the United States or its Territories, which is an independent document that meets both of the following requirements: (I) The document provides all of the information described in paragraphs (1) to (5), inclusive, of subdivision (e) of Section 1786.20. (II) The title of the document is printed in at least 14-point boldface type, and the content of the document is printed in at least 12-point type. (ii) This subparagraph shall not apply if the information to be obtained pertains or relates to matters that occurred outside of the United States or its territories,  or  was stored, processed, or prepared outside of the United States or its territories prior to the date the report was requested  , or was sent outside the United States or its territories solely for the purpose of transmitting or storing data  . (D) The consumer has authorized in writing the procurement of the report. (3) If an investigative consumer report is sought in connection with the hiring of a dwelling unit, as defined in subdivision (c) of Section 1940, the person procuring or causing the request to be made shall, not later than three days after the date on which the report was first requested, notify the consumer in writing that an investigative consumer report will be made regarding the consumer's character, general reputation, personal characteristics, and mode of living. The notification shall also include the name and address of the investigative consumer reporting agency that will prepare the report and a summary of the provisions of Section 1786.22. (4) The person procuring or causing the request to be made shall certify to the investigative consumer reporting agency that the person has made the applicable disclosures to the consumer required by this subdivision and that the person will comply with subdivision (b). (5) The person procuring the report or causing it to be prepared agrees to provide a copy of the report to the subject of the investigation, as provided in subdivision (b). (b) Any person described in subdivision (d) of Section 1786.12 who requests an investigative consumer report, in accordance with subdivision (a) regarding that consumer, shall do the following: (1) Provide the consumer a means by which the consumer may indicate on a written form, by means of a box to check, that the consumer wishes to receive a copy of any report that is prepared. If the consumer wishes to receive a copy of the report, the recipient of the report shall send a copy of the report to the consumer within three business days of the date that the report is provided to the recipient, who may contract with any other entity to send a copy to the consumer. The notice to request the report may be contained on either the disclosure form, as required by subdivision (a), or a separate consent form. The copy of the report shall contain the name, address, and telephone number of the person who issued the report and how to contact them. (2) Comply with Section 1786.40, if the taking of adverse action is a consideration. (c) Subdivisions (a) and (b) do not apply to an investigative consumer report procured or caused to be prepared by an employer, if the report is sought for employment purposes due to suspicion held by an employer of wrongdoing or misconduct by the subject of the investigation. (d) Those persons described in subdivision (d) of Section 1786.12 constitute the sole and exclusive class of persons who may cause an investigative consumer report to be prepared. SEC. 2. Section 1786.20 of the Civil Code is amended to read: 1786.20. (a) An investigative consumer reporting agency shall maintain reasonable procedures designed to avoid violations of Section 1786.18 and to limit furnishing of investigative consumer reports for the purposes listed under Section 1786.12. These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought and that the information will be used for no other purposes, and make the certifications described in paragraph (4) of subdivision (a) of Section 1786.16. From the effective date of this title, the investigative consumer reporting agency shall keep a record of the purposes for which information is sought, as stated by the user. The investigative consumer reporting agency may assume that the purpose for which a user seeks information remains the same as that which a user has previously stated. The investigative consumer reporting agency shall inform the user that the user is obligated to notify the agency of any change in the purpose for which information will be used. An investigative consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by the prospective user prior to furnishing the user any investigative consumer reports. An investigative consumer reporting agency may not furnish an investigative consumer report to a person unless it has a written agreement that the investigative consumer reports will be used by that person only for purposes listed in Section 1786.12. (b) Whenever an investigative consumer reporting agency prepares an investigative consumer report, it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. An investigative consumer reporting agency shall retain the investigative consumer report for two years after the report is provided. (c) An investigative consumer reporting agency may not make an inquiry for the purpose of preparing an investigative consumer report on a consumer for employment purposes if the making of the inquiry by an employer or prospective employer of the consumer would violate applicable federal or state equal employment opportunity law or regulation. (d) An investigative consumer reporting agency that prepares or processes in any manner an investigative consumer report, or any portion thereof, outside of the United States or its territories shall adopt a privacy protection policy with regard to the information contained in these reports. The investigative consumer reporting agency shall  publish   conspicuously post, as defined in subdivision (b) of Section 22577 of   the Business and Professions Code,  this privacy protection policy on an Internet Web site.  (e) An investigative consumer reporting agency that prepares or processes in any manner an investigative consumer report, or any portion thereof, outside the United States or its territories shall comply with Sections 1789.81.5 and 1798.82.   (e)   (f)  An investigative consumer reporting agency that prepares or processes in any manner an investigative consumer report, or any portion thereof, outside of the United States or its territories, shall disclose this fact to prospective users of the report. This disclosure shall be made regardless of whether the report, or portion thereof, was prepared or processed by a contractor, foreign affiliate, wholly owned entity, or an employee of the investigative consumer reporting agency. This disclosure shall be provided in an independent document printed in at least 12-point type, and shall contain all of the following information: (1) The country or countries where the report, or portion thereof, is being prepared or processed. (2) The specific information about the consumer that is being transmitted or transferred outside of the United States or its territories. (3) A hyperlink to the investigative consumer reporting agency's privacy protection policy prepared and published pursuant to subdivision (d). (4) Contact information, including  an   a name, mailing address,  e-mail address  ,  and  a  telephone number, of a representative of the investigative consumer reporting agency who can assist a consumer who is concerned that his or her information has been compromised as a result of being prepared or processed outside of the  Untied   United  States or its territories. (5) A description of the appropriate process for remedying a case of identity theft in the jurisdiction where the consumer resides, including the telephone number and mailing address of any agency responsible for consumer protection locally and nationally.  (f)   (g)  An investigative consumer reporting agency shall be liable to a consumer who is the subject of a report in the event that the consumer is harmed by any act or omission that occurs outside the United States or its territories as a result of the investigative consumer reporting agency preparing or processing an investigative consumer report, or portion thereof, outside of the United States or its territories.  (g)   (h)  In no event shall an investigative consumer reporting agency transmit, transfer, or communicate a consumer's social security number outside of the United States or its territories without first redacting the number so that only the last four digits are visible.  (h)   (i)  Subdivisions (d) to (g), inclusive, of this section shall not apply if the information to be obtained pertains or relates to matters that occurred outside of the United States or its territories,  or  was stored, processed, or prepared outside of the United States or its territories prior to the date the report was requested  , or was sent outside the United States or its territories solely for the purpose of transmitting or storing data  .