(a) Every consumer credit reporting agency shall maintain reasonable procedures designed to avoid violations of Section 1785.13 and to limit furnishing of consumer credit reports to the purposes listed under Section 1785.11. These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought and certify that the information will be used for no other purposes. From the effective date of this act the consumer credit reporting agency shall keep a record of the purposes as stated by the user. Every consumer credit reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by the prospective user prior to furnishing the user a consumer report. No consumer credit reporting agency may furnish a consumer credit report to any person unless the consumer credit reporting agency has reasonable grounds for believing that the consumer credit report will be used by the person for the purposes listed in Section 1785.11. A consumer credit reporting agency does not have reasonable grounds for believing that a consumer credit report will be used by the person for the purposes listed in Section 1785.11 unless all of the following requirements are met:
(1) If the prospective user is a retail seller, as defined in Section 1802.3, and intends to issue credit to a consumer who appears in person on the basis of an application for credit submitted in person, the consumer credit reporting agency shall, with a reasonable degree of certainty, match at least three categories of identifying information within the file maintained by the consumer credit reporting agency on the consumer with the information provided to the consumer credit reporting agency by the retail seller. The categories of identifying information may include, but are not limited to, first and last name, month and date of birth, driver’s license number, place of employment, current residence address, previous residence address, or social security number. The categories of information shall not include mother’s maiden name.
(2) If the prospective user is a retail seller, as defined in Section 1802.3, and intends to issue credit to a consumer who appears in person on the basis of an application for credit submitted in person, the retail seller certifies, in writing, to the consumer credit reporting agency that it instructs its employees and agents to inspect a photo identification of the consumer at the time the application was submitted in person. This paragraph does not apply to an application for credit submitted by mail.
(3) If the prospective user intends to extend credit by mail pursuant to a solicitation by mail, the extension of credit shall be mailed to the same address as on the solicitation unless the prospective user verifies any address change by, among other methods, contacting the person to whom the extension of credit will be mailed.
(b) Whenever a consumer credit reporting agency prepares a consumer credit report, it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. These reasonable procedures shall include, but not be limited to, permanent retention by the consumer credit reporting agency in the consumer’s file, or a separately individualized file, of that portion of the data in the file that is used by the consumer credit reporting agency to identify the individual consumer pursuant to paragraph (1) of subdivision (a). This permanently retained data shall be available for use in either a reinvestigation pursuant to subdivision (a) of Section 1785.16, an investigation where the consumer has filed a police report pursuant to subdivision (k) of Section 1785.16, or a restoration of a file involving the consumer. If the permanently retained identifying information is retained in a consumer’s file, it shall be clearly identified in the file in order for an individual who reviews the file to easily distinguish between the permanently stored identifying information and any other identifying information that may be a part of the file. This retention requirement shall not apply to data that is reported in error, that is obsolete, or that is found to be inaccurate through the results of a reinvestigation initiated by a consumer pursuant to subdivision (a) of Section 1785.16.
(c) No consumer credit reporting agency may prohibit any user of any consumer credit report furnished by the consumer credit reporting agency from disclosing the contents of the consumer credit report to the consumer who is the subject of the report if adverse action may be taken by the user based in whole or in part on the consumer credit report. The act of disclosure to the consumer by the user of the contents of a consumer credit report shall not be a basis for liability of the consumer credit reporting agency or the user under Section 1785.31.
(d) A consumer credit reporting agency shall provide a written notice to any person who regularly and in the ordinary course of business supplies information to the consumer credit reporting agency concerning any consumer or to whom a consumer credit report is provided by the consumer credit reporting agency. The notice shall specify the person’s obligations under this title. Copies of the appropriate code sections shall satisfy the requirement of this subdivision.
(Amended by Stats. 1997, Ch. 768, Sec. 1. Effective January 1, 1998. Operative July 1, 1998, by Sec. 7 of Ch. 768.)