23036.5.
(a) For purposes of this section:(1) “Database provider” means a third-party vendor that has entered into an agreement with the commissioner to administer a database.
(2) “Outstanding deferred deposit transaction” means a deferred deposit transaction listed in the database that has not been paid in full.
(b) (1) The commissioner shall, by July 1, 2019, develop, operate, and maintain an Internet Web site and common database in which a licensee shall, by the time period described below, record each deferred deposit
transaction for the purpose of preventing violations of this division. The database shall do all of the following:
(A) Allow licensees real-time access to information on deferred deposit transactions entered into the database through an Internet connection.
(B) Retain data in the database only as necessary to ensure compliance with this division.
(2) The commissioner may, consistent with existing contracting requirements, contract with a database provider to develop, operate, or maintain the database described in paragraph (1) on behalf of the department. If the commissioner does so, the commissioner shall include the following provisions in the contract:
(A) A provision requiring data to be archived 365 calendar days after it was first entered, and to allow the commissioner access to that archived data as necessary.
(B) A provision requiring the database provider to ensure that the data is confidential, except as otherwise authorized by this section.
(C) A provision requiring the database provider to comply with all requirements of this section relating to the database.
(c) On or after July 1, 2019, a licensee, before entering into any deferred deposit transaction, shall
conduct a search on the database to ensure that the customer does not have any outstanding deferred deposit transactions. If that customer does have has an outstanding deferred deposit transaction, the licensee shall not enter into a deferred deposit transaction with that customer.
(d) If the search conducted by the licensee under subdivision (c) reveals that the customer does not have any outstanding deferred deposit transaction, and that transaction otherwise meets all other requirements of this division, the licensee may enter into an agreement for that transaction with the customer. After entering into that agreement, the licensee shall submit the following:
(1) The applicant’s social security number. If the applicant cannot provide a social security number, the licensee shall submit an individual taxpayer identification number.
(2) When a deferred deposit transaction was initiated.
(3) When a deferred deposit transaction that was recorded in the database is paid in full.
(e) A licensee shall immediately correct any incorrect data that was previously entered into the database, including any information that the licensee becomes aware needs to be updated.
(f) If a licensee is unable to access the database due to technical difficulties, the licensee shall
not be in violation of any obligation to immediately record data pursuant to this section so long as the licensee records that data on the next business day following the day that the database becomes accessible, or complies with any alternate process to record that data established by the commissioner.
(g) A licensee shall maintain generally accepted security safeguards to maintain the confidentiality and security of information transmitted to the database, as determined by the commissioner.
(h) (1) The information contained in the database is confidential and not subject to public inspection, and the database and its contents are not subject to requests under the California Public Records Act, Chapter 3.5 (commencing with Section 6250) of Division
7 of Title 1 of the Government Code. A licensee may not disclose the information except as otherwise provided by law, including paragraph (2).
(2) Notwithstanding paragraph (1), the commissioner may publicly release aggregate data maintained in the database if the commissioner finds that the release is in the public interest. However, that release shall, in no instance, include personally identifying information of any customer or licensee, including a licensee that is a business or corporation.