CBA Publications >> CBA Regulatory Compliance Bulletin >> Vol 2002 No.17 October 11, 2002

Vol 2002 No. 17 October 11, 2002

Last Year's Identity Theft Bills Revised

AB 1068 addresses concerns raised by CBA and others regarding compliance with identity theft legislation passed last year (SB 168 and AB 655--see CBA Regulatory Compliance Bulletins No. 2001-15 and 2001-18). Many of the provisions of the new bill, not summarized here, affect consumer reporting agencies and users and preparers of investigative consumer reports, including for employment purposes. If you wish to examine these or wish to obtain a copy of the actual bill, go to http://www.leginfo.ca.gov and search for the bill number.

Social security numbers/EFTs. A provision of particular importance to banks, which CBA secured in the bill, is a one-year extension of the deadline to cease printing social security numbers on statements sent to customers where the information is imbedded in electronic fund transfers. Last year's bill, SB 168, prohibits the printing of an individual's social security number on any materials that are mailed to the individual except as required by law. This requirement became effective July 1 this year. In attempting to implement this requirement, banks found it difficult if not impossible to suppress or truncate the SSN on an automated manner where it is included in a field in an electronic funds transfer, which is common in transmissions from the Social Security Administration.

The new bill permits financial institutions to continue printing the SSN on account statements or similar documents mailed to affected individuals until July 1, 2003 if the transaction involved is governed by the rules of the National Automated Clearing House Association (NACHA), or it is initiated by a federal governmental entity through an automated clearing house network. The reason for the distinction is that transactions originated by federal government agencies are governed by federal regulations that are patterned after NACHA rules.

NACHA is presently engaged in the process of amending its rules so that participants in EFT transactions do not include SSNs in any of the transmission fields. Transmissions by the U.S. Treasury Department and its agencies such as the Social Security Administration, whose information systems are based on SSNs and who are the primary users of SSNs in EFT transactions, are more problematic. Federal government agencies are under no legal compulsion to reprogram their systems to excise or truncate the SSN, though a bill similar to SB 168 has been introduced in Congress by Senator Dianne Feinstein (S. 848).

Address verification. AB 655 required a creditor who uses a consumer credit report and discovers a discrepancy in an address to verify the address with the consumer by telephone or mail. AB 1068 deletes the specific requirement for a telephone call or letter. A creditor is under an obligation to take reasonable steps to verify the accuracy of the address provided on the application to confirm that it is not the result of identity theft.

It also imposes a duty to verify only in connection with the approval of an extension of credit, and not in all instances where a discrepancy is discovered. The bill also clarifies that the duty is not triggered where an existing open-end credit limit is increased or in connection with a change to or review of an existing credit account. The duty does not apply to US Army or Air Force post office addresses. If a consumer provides "initial written notice" to a creditor that the consumer is a victim of identity theft, the creditor must provide a written notice of the victim's credit protection rights under Civil Code Section 1785.16(k).

That section prescribes procedures for the identity theft victim to submit a copy of a police report or Department of Motor Vehicles investigative report to a consumer credit reporting agency to have the consumer's information blocked. The agency then has an obligation to notify furnishers of credit information that the consumer's information has been blocked. No form or further details are provided regarding the creditor's required written notice to a consumer apprising them of their Section 1785.16(k) rights.

Sale of credit. Existing law prohibits a creditor from selling a consumer debt (except to the creditor's subsidiary or affiliate) if the consumer's file is blocked or if the consumer notifies the creditor that he or she is a victim of identity theft. (Civil Code Section 1785.16.2). Under the new bill, the sale limitation applies only to the sale of a debt to a debt collector, and a sale to a subsidiary or affiliate is allowed only if the buyer takes no action to collect the debt. These restrictions apply only when the creditor receives notice from a consumer credit reporting agency of a blocked account pursuant to Civil Code Section 1785.16(k).

AB 1068 passed as an urgency measure, so it is effective as of September 29, 2002. Questions may be directed to James Clark or Pat Zenzola, the lead lobbyists on this bill at 916-441-7377.