On Monday, the Court of Appeal, Second Appellate District upheld the validity of California’s “security freeze” law, section 1785.11.2 of the California Civil Code, but nonetheless enjoined under the First Amendment its application to the U.D. Registry (“U.D.”), a provider of credit reports drawn in material part from public records.  U.D. Registry, Inc. v. State of California, B179653 & B186012 (October 30, 2006).

California’s Security Freeze Law

Section 1785.11.2, authored by Senator Debra Bowen, was enacted to enhance protection of consumers from identity theft by allowing them to place fraud alerts on their credit reports and to prevent or control the release of those reports, and by prohibiting specified government and business uses of social security numbers.

The security freeze law provides, among other things, that “[a] consumer may elect to place a security freeze on his or her credit report by making a request in writing by certified mail to a consumer credit reporting agency.”  If such a security freeze is in place, “information from a consumer’s credit report may not be released to a third party without prior express authorization from the consumer.”  A consumer credit reporting agency has five business days to place a freeze on a credit report after receiving a written request.

Section 1785.11.2 was intended in part to shift some of the identity theft burden from consumers to credit reporting agencies.  Also of concern to California lawmakers, as noted by the U.D. Registry court, was “a consumer’s right to control the use of his or her personal and financial information.”

The U.D. Registry

U.D. is a credit reporting agency that provides consumer credit reports to landowners who rent and lease apartments and property managers.  In order to change its computer system to comply with the security freeze law, U.D. would incur costs in excess of $50,000.

The Security Freeze Law Is Unconstitutional As Applied to U.D.

U.D. sought declaratory relief and to enjoin enforcement of section 1785.11.2, arguing that it is a content-based regulation that violated U.D.’s First Amendment right under the federal and California state Constitutions to disseminate truthful, lawfully obtained public record facts and other credit-related information, much of which was secured from federal and state court records.  The complaint against the State of California and Attorney General Bill Lockyer included a facial challenge to the statute and an as applied challenge with respect to enforcement against U.D.  The trial court enjoined enforcement of the security freeze law as to credit reports containing information derived from public records. 

The Court of Appeal concluded that section 1785.11.2 is unconstitutional as applied to U.D., and cannot be judicially reformed.  Applying the test for commercial speech enunciated in Cent. Hudson Gas & Elec. Corp. v. Public Serv. Comm’n, 447 U.S. 557, 566 (1980), the court found it undisputed that U.D.’s credit reports “neither relate to unlawful activity nor are misleading.  . . . Of material consequence is that court records of the type utilized by plaintiff are presumptively open for public examination  . . . These reports benefit consumers by facilitating the extension of credit.  They benefit lessors by identifying potential lessees who are bad credit risks.”

Despite acknowledging that protecting consumers from identity theft is a compelling state interest, and that the statute directly advances that interest, the court found that the statute contains “excessive restrictions” by preventing disclosure of data contained in court records “which are constitutionally presumptively available to journalists and the public.”  Further, the statute cannot be reformed because “[t]he Legislature never intended, much less even contemplated, that once the consumer’s written notice was received, the credit reporting agency would have to peer over the information to ascertain whether there is data which is not ‘contained in and/or obtained from public records’ as the trial court’s order in effect requires.”

The Security Freeze Law is Not Unconstitutional on its Face

Importantly, the court found that the security freeze law is not invalid in its entirety and may be enforced in some circumstances.  “If a credit report contains only false information, then section 1785.11.2 could constitutionally be used to prevent its release.  There are logically conceivable circumstances where a consumer can forestall the release of credit information the Constitution does not protect.  Hence, . . . defendants have demonstrated that there is not a ‘total and fatal’ conflict between section 1785.11.2 and the First Amendment.” 

The court directed entry of an injunction against defendants insofar as they attempt to enforce the law against U.D., but reversed the judgment insofar as it barred enforcement of section 1785.11.2 against any other party.