1094.5.
If the director allows the conveyance of wage information pursuant to paragraph (2) of subdivision (e) of Section 1094, all of the following shall apply:(a) The information provided shall only be used to verify the accuracy of wage information provided to the creditor by an employee in connection with a specific credit transaction.
(b) All state and federal privacy laws shall be met.
(c) The information shall only be used to satisfy standard underwriting requirements imposed by the creditor for that specific credit transaction.
(d) (1) An
employee’s wage information shall only leave a department database on an individual inquiry basis and shall not be grouped together with other employee’s wage information.
(2) Data removed from the dedicated department database shall be encrypted at the field level, and shall not contain any personal identifying information.
(3) The department’s database shall not leave the physical premises of the Employment Development Department.
(e) The information shall only be transmitted as an individual record and shall not be transmitted with additional data.
(f) A copy of the information and an explanation of the purpose for which the information was furnished shall be provided to the
employee.
(g) The form of release made by an employee pursuant to paragraph (2) of subdivision (e) of Section 1094 shall comply with Section 603.5(d)(2) of Part 603 of Chapter V of Title 20 of the Code of Federal Regulations and additionally include the following information:
(1) The employee’s consent to disclose is voluntary and not required by law.
(2) The employee’s refusal to consent to disclosure of this wage information shall not be the basis for denial of credit.
(3) If the employee’s release is provided, the department shall release, the wage information of the employee.
(4) The release shall be only for the credit transaction identified by the employee on the release.
(5) The length of time the consent shall be valid following the execution of the release by the employee.
(6) A statement indicating the person or persons that are authorized to receive the information released.
(h) The director shall establish audit and security requirements deemed necessary or appropriate by the director to safeguard the confidentiality of the information released.
(i) Prior to implementing paragraph (2) of subdivision (e) of Section 1094, the director shall evaluate the best practices and system weaknesses of similar programs in other states.
(j) The director may convene a group consisting of representatives from consumer privacy groups, creditors, and employee and
employer organizations to advise him or her and the department on the best practices and weaknesses of a program of this nature.
(k) (1) The director may enter into a contract with a consumer reporting agency to implement this section. The director may require reimbursement for all costs incurred in providing information specified in this section.
(2) An employee shall not be charged for submitting the release for the costs of transmitting his or her information directly to a creditor for the purpose of a credit transaction.
(l) The department may promulgate regulations as necessary or appropriate to implement this section.
(m) (1) A
person who knowingly and wrongfully accesses, uses, or discloses information under this section is guilty of a misdemeanor.
(2) A person injured by a violation of this section may bring a civil action to recover damages, attorney’s fees, and costs of litigation.
(n) For purposes of this section:
(1) “Consumer reporting agency” has the same meaning as set forth in the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681a(f)).
(2) “Creditor” has the same meaning as set forth in the federal Fair Debt Collection Practices Act (15 U.S.C. Sec. 1691a(e)).