(a) Every consumer credit reporting agency shall maintain reasonable procedures designed to avoid violations of Section 1785.13 and to limit furnishing of consumer credit reports to the purposes listed under Section 1785.11. These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought and certify that the information will be used for no other purposes. From the effective date of this act the consumer credit reporting agency shall keep a record of the purposes as stated by the user. Every consumer credit reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by the prospective user prior to furnishing the user a consumer report. No consumer credit reporting agency may furnish a consumer credit report to any person unless the consumer credit reporting agency has reasonable grounds for believing that the consumer credit report will be used by the person for the purposes listed in Section 1785.11. A consumer credit reporting agency does not have reasonable grounds for believing that a consumer credit report will be used by the person for the purposes listed in Section 1785.11 unless all of the following requirements are met: (1) If the prospective user is a retail seller, as defined in Section 1802.3, and intends to issue credit to a consumer who appears in person on the basis of an application for credit submitted in person, the consumer credit reporting agency shall, with a reasonable degree of certainty, match at least three categories of identifying information within the file maintained by the consumer credit reporting agency on the consumer with the information provided to the consumer credit reporting agency by the retail seller. The categories of identifying information may include, but are not limited to, first and last name, month and date of birth, driver's license number, place of employment, current residence address, previous residence address, or social security number. The categories of information shall not include mother's maiden name.

(2) If the prospective user is a retail seller, as defined in Section 1802.3, and intends to issue credit to a consumer who appears in person on the basis of an application for credit submitted in person, the retail seller certifies, in writing, to the consumer credit reporting agency that it instructs its employees and agents to inspect a photo identification of the consumer at the time the application was submitted in person. This paragraph does not apply to an application for credit submitted by mail.

(3) If the prospective user intends to extend credit by mail pursuant to a solicitation by mail, the extension of credit shall be mailed to the same address as on the solicitation unless the prospective user verifies any address change by, among other methods, contacting the person to whom the extension of credit will be mailed.

(b) Whenever a consumer credit reporting agency prepares a consumer credit report, it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. These reasonable procedures shall include, but not be limited to, permanent retention by the consumer credit reporting agency in the consumer's file, or a separately individualized file, of that portion of the data in the file that is used by the consumer credit reporting agency to identify the individual consumer pursuant to paragraph (1) of subdivision (a). This permanently retained data shall be available for use in either a reinvestigation pursuant to subdivision (a) of Section 1785.16, an investigation where the consumer has filed a police report pursuant to subdivision (k) of Section 1785.16, or a restoration of a file involving the consumer. If the permanently retained identifying information is retained in a consumer's file, it shall be clearly identified in the file in order for an individual who reviews the file to easily distinguish between the permanently stored identifying information and any other identifying information that may be a part of the file. This retention requirement shall not apply to data that is reported in error, that is obsolete, or that is found to be inaccurate through the results of a reinvestigation initiated by a consumer pursuant to subdivision (a) of Section 1785.16.

(c) No consumer credit reporting agency may prohibit any user of any consumer credit report furnished by the consumer credit reporting agency from disclosing the contents of the consumer credit report to the consumer who is the subject of the report if adverse action may be taken by the user based in whole or in part on the consumer credit report. The act of disclosure to the consumer by the user of the contents of a consumer credit report shall not be a basis for liability of the consumer credit reporting agency or the user under Section 1785.31.

(d) A consumer credit reporting agency shall provide a written notice to any person who regularly and in the ordinary course of business supplies information to the consumer credit reporting agency concerning any consumer or to whom a consumer credit report is provided by the consumer credit reporting agency. The notice shall specify the person's obligations under this title. Copies of the appropriate code sections shall satisfy the requirement of this subdivision.

SEC. 2. Section 1785.16 of the Civil Code is amended to read:

1785.16.

(a) If the completeness or accuracy of any item of information contained in his or her file is disputed by a consumer, and the dispute is conveyed directly to the consumer credit reporting agency by the consumer or user on behalf of the consumer, the consumer credit reporting agency shall within a reasonable period of time and without charge reinvestigate and record the current status of the disputed information before the end of the 30-business-day period beginning on the date the agency receives notice of the dispute from the consumer or user, unless the consumer credit reporting agency has reasonable grounds to believe and determines that the dispute by the consumer is frivolous or irrelevant, including by reason of a failure of the consumer to provide sufficient information, as requested by the consumer credit reporting agency, to resolve the dispute. Unless the consumer credit reporting agency determines that the dispute is frivolous or irrelevant, before the end of the five-business-day period beginning on the date the consumer credit reporting agency receives notice of dispute under this section, the agency shall notify any person who provided information in dispute at the address and in the manner specified by the person. A consumer credit reporting agency may require that disputes by consumers be in writing.

(b) In conducting such a reinvestigation the consumer credit reporting agency shall review and consider all relevant information submitted by the consumer with respect to the disputed item of information. If the consumer credit reporting agency determines that the dispute is frivolous or irrelevant, it shall notify the consumer by mail or, if authorized by the consumer for that purpose, by any other means available to the consumer credit reporting agency, within five business days after that determination is made that it is terminating its reinvestigation of the item of information. In this notification, the consumer credit reporting agency shall state the specific reasons why it has determined that the consumer's dispute is frivolous or irrelevant. If the disputed item of information is found to be inaccurate, missing, or can no longer be verified by the evidence submitted, the consumer credit reporting agency shall promptly add, correct, or delete that information from the consumer's file.

(c) No information may be reinserted in a consumer's file after having been deleted pursuant to this section unless the person who furnished the information verifies that the information is accurate. If any information deleted from a consumer's file is reinserted in the file, the consumer credit reporting agency shall promptly notify the consumer of the reinsertion in writing or, if authorized by the consumer for that purpose, by any other means available to the consumer credit reporting agency. As part of, or in addition to, this notice the consumer credit reporting agency shall, within five business days of reinserting the information, provide the consumer in writing (1) a statement that the disputed information has been reinserted,

(2) a notice that the agency will provide to the consumer, within 15 days following a request, the name, address, and telephone number of any furnisher of information contacted or which contacted the consumer credit reporting agency in connection with the reinsertion,

(3) the toll-free telephone number of the consumer credit reporting agency that the consumer can use to obtain this name, address, and telephone number, and

(4) a notice that the consumer has the right to a reinvestigation of the information reinserted by the consumer credit reporting agency and to add a statement to his or her file disputing the accuracy or completeness of the information.

(d) A consumer credit reporting agency shall provide notice to the consumer of the results of any reinvestigation under this subdivision, within five days of completion of the reinvestigation. The notice shall include (1) a statement that the reinvestigation is completed,

(2) a consumer credit report that is based on the consumer's file as that file is revised as a result of the reinvestigation,

(3) a description or indication of any changes made in the consumer credit report as a result of those revisions to the consumer's file,

(4) a notice that, if requested by the consumer, a description of the procedure used to determine the accuracy and completeness of the information shall be provided to the consumer by the consumer credit reporting agency, including the name, business address, and telephone number of any furnisher of information contacted in connection with that information,

(5) a notice that the consumer has the right to add a statement to the consumer's file disputing the accuracy or completeness of the information, and

(6) a notice that the consumer has the right to request that the consumer credit reporting agency furnish notifications under subdivision (h). A consumer credit reporting agency shall provide the notice pursuant to this subdivision respecting the procedure used to determine the accuracy and completeness of information, not later than 15 days after receiving a request from the consumer.

(e) The presence of information in the consumer's file that contradicts the contention of the consumer shall not, in and of itself, constitute reasonable grounds for believing the dispute is frivolous or irrelevant.

(f) If the consumer credit reporting agency determines that the dispute is frivolous or irrelevant, or if the reinvestigation does not resolve the dispute, or if the information is reinserted into the consumer's file pursuant to subdivision (c), the consumer may file a brief statement setting forth the nature of the dispute. The consumer credit reporting agency may limit these statements to not more than 100 words if it provides the consumer with assistance in writing a clear summary of the dispute.

(g) Whenever a statement of dispute is filed, the consumer credit reporting agency shall, in any subsequent consumer credit report containing the information in question, clearly note that the information is disputed by the consumer and shall include in the report either the consumer's statement or a clear and accurate summary thereof.

(h) Following the deletion of information from a consumer's file pursuant to this section, or following the filing of a statement of dispute pursuant to subdivision (f), the consumer credit reporting agency shall, at the request of the consumer, furnish notification that the item of information has been deleted or that the item of information is disputed. In the case of disputed information, the notification shall include the statement or summary of the dispute filed pursuant to subdivision (f). This notification shall be furnished to any person, specifically designated by the consumer, who has, within two years prior to the deletion or the filing of the dispute, received a consumer credit report concerning the consumer for employment purposes, or who has, within six months of the deletion or the filing of the dispute, received a consumer credit report concerning the consumer for any other purpose, if these consumer credit reports contained the deleted or disputed information. The consumer credit reporting agency shall clearly and conspicuously disclose to the consumer his or her rights to make a request for this notification. The disclosure shall be made at or prior to the time the information is deleted pursuant to this section or the consumer's statement regarding the disputed information is received pursuant to subdivision (f).

(i) A consumer credit reporting agency shall maintain reasonable procedures designed to prevent the reappearance in a consumer's file and in consumer credit reports of information that has been deleted pursuant to this section and not reinserted pursuant to subdivision (c).

(j) If the consumer's dispute is resolved by deletion of the disputed information within three business days, beginning with the day the consumer credit reporting agency receives notice of the dispute in accordance with subdivision (a), and provided that verification thereof is provided to the consumer in writing within five business days following the deletion, then the consumer credit reporting agency shall be exempt from requirements for further action under subdivisions (d), (f), and (g).

(k) If a consumer submits to a credit reporting agency a copy of a valid police report filed pursuant to Section 530.5 of the Penal Code, the consumer credit reporting agency shall promptly and permanently block reporting any information that the consumer alleges appears on his or her credit report as a result of a violation of Section 530.5 of the Penal Code so that the information cannot be reported. The consumer credit reporting agency shall promptly notify the furnisher of the information that the information has been so blocked. Furnishers of information and consumer credit reporting agencies shall ensure that information is unblocked only upon a preponderance of the evidence establishing the facts required under paragraph (1), (2), or (3). The permanently blocked information shall be unblocked only if: (1) the information was blocked due to fraud, or (2) the consumer agrees that the blocked information, or portions of the blocked information, were blocked in error, or (3) the consumer knowingly obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions or the consumer should have known that he or she obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions. If blocked information is unblocked pursuant to this subdivision, the consumer shall be promptly notified in the same manner as consumers are notified of the reinsertion of information pursuant to subdivision (c). The prior presence of the blocked information in the consumer credit reporting agency's file on the consumer is not evidence of whether the consumer knew or should have known that he or she obtained possession of any goods, services, or moneys. For the purposes of this subdivision, fraud may be demonstrated by circumstantial evidence. In unblocking information pursuant to this subdivision, furnishers and consumer credit reporting agencies shall be subject to their respective requirements pursuant to this title regarding the completeness and accuracy of information.

SEC. 3. Section 1785.30 of the Civil Code is amended to read:

1785.30. Upon notification of the results of a consumer credit reporting agency's reinvestigation pursuant to Section 1785.16, an consumer may make a written demand on any person furnishing information to the consumer credit reporting agency to correct any information which the consumer believes to be inaccurate. The person upon whom the written demand is made shall acknowledge the demand within 30 days. The consumer may require the consumer credit reporting agency to indicate on any subsequent reports issued during the dispute that the item or items of information are in dispute. If upon investigation the information is found to be inaccurate or incorrect, the consumer may require the consumer credit reporting agency to delete or correct the item or items of information within a reasonable time. If within 90 days the consumer credit reporting agency does not receive any information from the person requested to furnish the same or any communication relative to this information from this person, the consumer credit reporting agency shall delete the information from the report.

SEC. 4. Section 1785.31 of the Civil Code is amended to read:

1785.31.

(a) Any consumer who suffers damages as a result of a violation of this title by any person may bring an action in a court of appropriate jurisdiction against that person to recover the following: (1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorney's fees and, when applicable, pain and suffering.

(2) In the case of a willful violation:

(A) Actual damages as set forth in paragraph (1) above:
(B) Punitive damages of not less than one hundred dollars ($100) nor more than five thousand dollars ($5,000) for each violation as the court deems proper;
(C) Any other relief which the court deems proper. (3) In the case of liability of a natural person for obtaining a consumer credit report under false pretenses or knowingly without a permissible purpose, an award of actual damages pursuant to paragraph (1) or subparagraph (A) of paragraph (2) shall be in an amount of not less than two thousand five hundred dollars ($2,500).