The people of the State of California do enact as follows:


SECTION 1.
Section 1785.11.9 is added to the Civil Code, to read:
1785.11.9.
For purposes of Sections 1785.11.10 and 1785.11.11, the following terms shall have the following meanings:
(a) “Protected consumer” means an individual who is any of the following:
(1) Under 16 years of age at the time a request for the placement of a security freeze is made.
(2) An incapacitated person or a protected person for whom a guardian or conservator has been appointed.
(3) Under the jurisdiction of a county welfare department or county probation department, has been placed in a foster care setting, and is under 16 years of age at the time a request for placement of a security freeze is made.
(b) “Record” means a compilation of information that:
(1) Identifies a protected consumer.
(2) Was created by a consumer credit reporting agency solely for the purpose of complying with this section.
(3) Is not otherwise authorized to be created or used to consider the protected consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.
(c) (1) “Representative” means a person who provides to a consumer credit reporting agency sufficient proof of authority to act on behalf of a protected consumer.
(2) For a protected consumer who has been placed in a foster care setting, “representative” means either of the following:
(A) A county welfare department or its agent or designee.
(B) A county probation department or its agent or designee.
(3) For a protected consumer who has been placed in a foster care setting, “representative” does not mean a foster parent.
(d) “Security freeze” means:
(1) If a consumer credit reporting agency does not have a file pertaining to a protected consumer, a restriction that:
(A) Is placed on the protected consumer’s record in accordance with this section.
(B) Prohibits the consumer credit reporting agency from releasing the protected consumer’s record except as authorized in this section.
(2) If a consumer credit reporting agency has a file pertaining to a protected consumer, a restriction that:
(A) Is placed on the protected consumer’s consumer credit report in accordance with this section.
(B) Prohibits the consumer credit reporting agency from releasing the protected consumer’s consumer credit report or any information derived from the protected consumer’s consumer credit report except as authorized in this section.
(e) “Sufficient proof of authority” means documentation that shows that a representative has authority to act on behalf of a protected consumer in a financial matter. This documentation includes, but is not limited to:
(1) A court order or relevant enabling document issued by a court.
(2) A legally sufficient and valid power of attorney, or a durable power of attorney.
(3) A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer, including a temporary conservator or temporary guardian.
(4) A written communication from a county welfare department or its agent or designee or a county probation department or its agent or designee certifying that the protected consumer is a foster youth under its jurisdiction.
(f) “Sufficient proof of identification” means information or documentation that identifies a protected consumer or a representative of a protected consumer. This information or documentation includes, but is not limited to:
(1) A social security number or a copy of a social security card issued by the Social Security Administration.
(2) A certified copy or official copy of a birth certificate issued by the entity authorized to issue the birth certificate.
(3) A copy of a driver’s license, an identification issued by the Department of Motor Vehicles, or any other government-issued identification.
(4) A copy of a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services that shows a name and a home address.
(5) A written communication from a county welfare department or its agent or designee or a county probation department or its agent or designee certifying that the protected consumer is a foster youth under its jurisdiction.
SEC. 2.
Section 1785.11.10 is added to the Civil Code, to read:
1785.11.10.
Sections 1785.11.9 to 1785.11.11, inclusive, do not apply to the use of a protected consumer’s consumer credit report or record by any of the following:
(a) A person or entity listed in paragraph (1) or (2) of subdivision (l) of Section 1785.11.2, or Section 1785.11.4 or 1785.11.6.
(b) A person administering a credit file monitoring subscription service to which the representative of the protected consumer has subscribed on behalf of the protected consumer.
(c) A person who provides the protected consumer or the protected consumer’s representative with a copy of the protected consumer’s consumer credit report at the request of the protected consumer or at the request of the protected consumer’s representative.
(d) Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
(e) A child support agency acting pursuant to Chapter 2 (commencing with Section 17400) of Division 17 of the Family Code and Title IV-D of the Social Security Act (42 U.S.C. Sec. 651 et seq.).
(f) The State Department of Health Care Services or its agents or assigns acting to investigate Medi-Cal fraud.
(g) The Franchise Tax Board or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.
SEC. 3.
Section 1785.11.11 is added to the Civil Code, to read:
1785.11.11.
(a) A consumer credit reporting agency shall place a security freeze for a protected consumer if both of the following occur:
(1) The consumer credit reporting agency receives a request from the protected consumer’s representative for the placement of the security freeze pursuant to this section.
(2) The protected consumer’s representative does all of the following:
(A) Submits the request to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.
(B) Provides to the consumer credit reporting agency sufficient proof of identification of the protected consumer and the representative.
(C) Provides to the consumer credit reporting agency sufficient proof of authority to act on behalf of the protected consumer.
(D) Pays to the consumer credit reporting agency a fee as authorized by subdivision (i).
(b) If a consumer credit reporting agency does not have a file pertaining to a protected consumer when the consumer credit reporting agency receives a request pursuant to paragraph (1) of subdivision (a), the consumer credit reporting agency shall create a record for the protected consumer.
(c) If a protected consumer’s representative requests a security freeze, the consumer credit reporting agency shall disclose the process for placing and removing a security freeze.
(d) Within 30 days after receiving a request that meets the requirements of subdivision (a), a consumer credit reporting agency shall place a security freeze for the protected consumer. The consumer credit reporting agency shall send written confirmation of the security freeze to the address on file within 10 days of the placement of the security freeze.
(e) Unless a security freeze for a protected consumer is removed pursuant to subdivision (h) or (j), a consumer credit reporting agency shall not release the protected consumer’s consumer credit report, any information derived from the protected consumer’s consumer credit report, or any record created for the protected consumer.
(f) A security freeze for a protected consumer placed pursuant to this section shall remain in effect until either of the following occurs:
(1) The protected consumer or the protected consumer’s representative requests that the consumer credit reporting agency remove the security freeze in accordance with subdivision (h).
(2) The security freeze is removed in accordance with subdivision (j).
(g) To remove a security freeze, a protected consumer or a protected consumer’s representative shall do all of the following:
(1) Submit a request for removal of the security freeze to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency.
(2) Provide to the consumer credit reporting agency:
(A) If the request is made by the protected consumer:
(i) Proof that the sufficient proof of authority for the protected consumer’s representative to act on behalf of the protected consumer is no longer valid, he or she has been emancipated, or he or she is 16 years of age or older.
(ii) Sufficient proof of identification of the protected consumer.
(B) If the request is made by the representative of a protected consumer:
(i) Sufficient proof of identification of the protected consumer and the representative.
(ii) Sufficient proof of authority to act on behalf of the protected consumer.
(3) Pay to the consumer credit reporting agency a fee as authorized by subdivision (i).
(h) Within 30 days after receiving a request that meets the requirements of subdivision (g), a consumer credit reporting agency shall remove a security freeze for a protected consumer.
(i) (1) Except as provided in paragraph (2), a consumer credit reporting agency may not charge a fee for any service performed pursuant to this section.
(2) A consumer credit reporting agency is authorized to charge a reasonable fee, not exceeding ten dollars ($10), for each placement or removal of a security freeze for a protected consumer.
(3) Notwithstanding paragraph (2), a consumer credit reporting agency shall not charge any fee pursuant to this section under any of the following circumstances:
(A) The protected consumer’s representative has received a report of alleged identity theft against the protected consumer under Section 530.5 of the Penal Code and has provided copy of the report to the consumer credit reporting agency.
(B) The request for the placement or removal of a security freeze is for a protected consumer who is under 16 years of age at the time of the request and the consumer credit reporting agency has a report pertaining to the protected consumer.
(C) The request for the placement or removal of a security freeze is for a protected consumer who has been placed in a foster care setting.
(j) A consumer credit reporting agency is authorized to remove a security freeze for a protected consumer or to delete a record of a protected consumer if the security freeze was placed or the record was created based upon a material misrepresentation of fact by the protected consumer or the protected consumer’s representative.
(k) A consumer credit reporting agency may develop procedures involving the use of telephone, mail, fax, the Internet, or other electronic media to receive and process a request for a protected consumer’s security freeze to be placed or removed.
Existing state law defines and regulates consumer credit reports and authorizes a consumer to place a security freeze on his or her credit report by making a request in writing by mail to a consumer credit reporting agency. Existing state law requires a consumer credit reporting agency to place the security freeze on the consumer’s credit report no later than 3 business days after receiving the consumer’s request.
This bill would require a consumer credit reporting agency to place a security freeze for a protected consumer, defined as an individual who is under 16 years of age at the time a request for the placement of a security freeze is made, an incapacitated person or a protected individual for whom a guardian or conservator has been appointed, or a person under the jurisdiction of a county welfare department or county probation department who has been placed in a foster care setting and is under 16 years of age at the time a request for a security freeze is made, upon that consumer’s representative’s request and compliance with certain requirements. The bill would require a consumer credit reporting agency to send written confirmation of the security freeze to the address on file within 10 days of the placement of the security freeze.
An act to add Sections 1785.11.9, 1785.11.10, and 1785.11.11 to the Civil Code, relating to consumer credit reports.