Compliance Newshub
State News

This topic consolidates legislative summaries of new and revised state laws pertaining to licensing, originating, and servicing mortgage loans. 

News Search

From
To
Search

September 21, 2018

Assembly Bill No. 3212 California Modifies Provisions Regarding Service Member Protections

AB 3212 extends the length of time that service members are protected against foreclosure, eviction, repossession, and default judgments. It also extends to them interest rate protections for student loans and clarifies that students in the National Guard and Reserve have a right to academic leave when they are called to active duty. The bill updates current law to close loopholes that have been used to take advantage of service members and extends the protections of California law to cover all service members in California. Prior to this new law, some protections only applied to members of the Guard and Reserve who are called to active duty. 

See link for complete Bill text.

View Source

September 18, 2018

California Enacts Additional Limits on Collecting Time Barred Debts

Ballard Spahr--Heather S. Klein

Beginning in 2019, all California “debt collectors”—including creditors collecting their own debts regularly and in the ordinary course of business—will be required to provide notice to debtors when collecting on debts that are past the statute of limitations and will be prohibited from suing on such debts. The new law is based on provisions in the 2013 California Fair Debt Buying Practices Act. However, unlike the 2013 Act, which limited the notice requirement to “debt buyers,” the new law extends the notice requirement to any collector, wherever located, that is engaged in collecting a debt from a California consumer.

The notice requirements have been added to the Rosenthal Fair Debt Collections Practices Act, which applies to “any person who, in the ordinary course of business, regularly, on behalf of himself or herself or others, engages in debt collection.” Under the new law, collectors must deliver one form of notice if an account is reported to credit bureaus and another form if it is beyond the Fair Credit Reporting Act’s seven-year limitation period, or date for obsolescence. (There is no separate notice for a collector who has not reported, and will not report, an account to credit bureaus for any other reason.)

The notices, which are identical to those in the 2013 California debt buying law, must be “included in the first written communication provided to the debtor after the debt has become time-barred” or “after the date for obsolescence,” respectively. “First written communication” means “the first communication sent to the debtor in writing or by facsimile, email or other similar means.” We recommend that clients who email the “first written communication” ensure they receive an effective consent to receive electronic communications from debtors.

We surmise that the BCFP may be studying California’s disclosures as the BCFP formulates its notice of proposed rulemaking for third-party debt collection, which it has said it will issue next year. The 2013 advance notice of proposed rulemakingand 2016 outline of proposals issued by the Cordray-era Bureau suggested it was considering limits on the collection of time-barred debts. Therefore, California’s new law may influence any ongoing discussions and drafting by the Bureau’s current staff and leadership on this point.

The new California law also amends the statute of limitations provision in Section 337 of the California Code of Civil Procedure to prohibit any person from bringing suit or initiating an arbitration or other legal proceeding to collect certain debts after the four year limitations period has run. With this amendment, the expiration of the statute of limitations will be an outright prohibition to suit, rather than an affirmative defense that must be raised by the consumer.

View Source

Are You Up to Date?

Search our Compliance Calendar for current regulatory changes & updates.

Search Now

September 12, 2018

North Carolina Adopts Servicing Provisions under Title 04, Chapter 3, Banking Commission

The North Carolina Department of Commerce, Office of the Commissioner of Banks, has completed an initial review and adopted multiple provisions under its Title 04, Chapter 3, Banking Commission. This chapter contains multiple statutes; many of which have been repealed. Listed below are those statutes applicable to mortgage servicing that have been readopted. These provisions are effective August 1, 2018.

1. 04 NCAC 03M .0701 Transfer of Servicing Rights

A person shall not transfer servicing rights or obligations to a person unless that person holds a mortgage servicing license or is a person exempt from the Act pursuant to G.S. 53-244.040.

  • History Note: Authority 53-244.100(a); 53-244.110(1); 53-244.110(3)
  • Eff. May 1, 2010
  • Readopted Eff. August 1, 2018

2. 04 NCAC 03M .0702 Requirements for Mortgage Services to Communicate Effectively with Borrowers Regarding Loss Mitigation

(a) A mortgage servicer shall acknowledge in writing a borrower's loss mitigation request no later than 10 business days after the request. The acknowledgement shall identify information needed from the borrower in order for the mortgage servicer to consider the borrower's loss mitigation request. For purposes of this Rule and Rule .0703 of this Subchapter, a loss mitigation request is considered received by a servicer upon the borrower or the borrower's agent by contacting the servicer at the address, phone, or other contact information required to be provided to borrowers in a notice complying with G.S. 53-244.111(22).

(b) A mortgage servicer shall respond to a loss mitigation request from a borrower no later than 30 business days after the receipt of all information necessary from the borrower to assess whether or not a borrower qualifies for any loss mitigation programs offered by the mortgage servicer.

(c) A mortgage servicer shall include in a final response denying a loss mitigation request the reason for the denial and contact information for a person at the mortgage servicer with authority to reconsider the denial. In addition, the denial shall also include the following statement, in a boldface type and in a print no smaller than the largest print used elsewhere in the main body of the denial: "If you believe the loss mitigation request has been wrongly denied, you may file a complaint with the North Carolina Office of the Commissioner of Banks website, www.nccob.gov."

  • History Note: Authority G.S. 53-244.110(7); 53-244.118(a)
  • Eff. June 1, 2010
  • Readopted Eff. August 1, 2018

3. 04 NCAC 03M .0703 Cessation of Foreclosure Activities During Pendency of Loss Mitigation Requests

(a) A mortgage servicer shall not initiate or further a foreclosure proceeding or impose a charge incident to a foreclosure proceeding during the pendency of a loss mitigation request. This requirement does not apply if:

(1) the borrower has failed to comply with the terms of a loss mitigation plan within the previous 12 months, if the loss mitigation plan:

(A) was implemented pursuant to a Federal or State foreclosure prevention program, including the Home Affordable Modification Program; or

(B) reduced the monthly payment of loan by six percent from the scheduled monthly payment and resulted in a monthly payment of principal, interest, taxes, and insurance of less than 31 percent of the borrower's household income;

(2) the mortgage servicer has provided a final response regarding a loss mitigation request within the last 12 months and believes that the current loss mitigation request was not made in good faith;

(3) the borrower has failed to comply with a Chapter 13 bankruptcy repayment plan or has had any bankruptcy proceedings dismissed for abuse of process within the last 12 months;

(4) the loss mitigation request is received by the servicer after the time for appealing an order granting foreclosure of the secured residential real estate has passed in accordance with Article 2A of Chapter 45; or

(5) the servicing contract or the terms of the mortgage loan, entered into prior to October 1, 2009, prohibits such a delay.

(b) Nothing in this Rule shall prevent a mortgage servicer, in order to avoid dismissal or any other adverse order in a foreclosure proceeding that was initiated prior to the loss mitigation request being received, from filing or causing to be filed any pleading or notice that is required under Article 2A of Chapter 45, the Rules of Civil Procedure, or the Local Rules of Court to continue or delay further proceedings.

  • History Note: Authority G.S. 53-244.110(7); 53-244.118(a)
  • Eff. June 1, 2010
  • Readopted Eff. August 1, 2018
View Source

September 12, 2018

California Amends Provisions Regarding Consumer Protection

California Senate Bill 1201 amends Section 1632.5 of the Civil Code and Section 50200 of the Financial Code, relating to contracts. Specifically, 

  • Requires a supervised financial organization that negotiates the modification of any of the terms of a loan or extension of credit secured by residential real property primarily in Spanish, Chinese, Tagalog, Vietnamese, or Korean, and that offers a borrower a final loan modification in writing, to deliver to that borrower, at the time the final loan modification offer is made, a specified form summarizing the modified loan terms in the same language as the negotiation.
  • Requires delivery of an applicable form or forms for transactions subject to certain federal regulations, and in this regard would authorize the Department of Business Oversight, in making available each of its forms in each of the languages set forth above, to use as guidance 2 additional forms from the Consumer Financial Protection Bureau and 3 additional forms from the Federal National Mortgage Association.
  • These provisions become operative 90 days following the issuance of the forms by the Department of Business Oversight, but in no instance before January 1, 2019.

Additionally, Under existing law, the California Residential Mortgage Lending Act, if a licensee that is required to make an audit fails to do so, the Commissioner of Business Oversight is authorized to have the audit made by an independent certified public accountant at the licensee’s expense.  Existing law authorizes the commissioner to summarily revoke the license of a licensee who fails to file a certified financial statement prepared by an independent certified public accountant, as specified.

This bill would specify that, if, after a revocation order is made, a request for hearing is filed in writing and a hearing is not held within a specified period of time, the order would be deemed rescinded as of its effective date. The bill would prohibit a licensee, during the revocation period, from conducting business, except as specified. The bill would provide that the revocation of a license does not affect the powers of the commissioner pursuant to the act.

View Source

September 12, 2018

Florida Adopts Provisions Regarding LO Licensing for Military Members

Florida has adopted new provisions in rule 69V-40.002; specifically licensure fee waivers for active military members, veterans, and/or spouses. This new provision is effective September 25, 2018.

Persons wishing to obtain a waiver of licensure fees as set forth in section 494.00312(8), F.S., shall submit to the Office of Financial Regulation, via electronic filing through the Registry, a completed Office of Financial Regulation Active Military Member/Veteran/Spouse Fee Waiver and Military Service Verification, Form OFR-MIL-001, effective 09-2018, which is hereby incorporated by reference, and also incorporated by reference in rule 69V-40.002, F.A.C., and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-09912. Such form must be submitted within one hundred eighty (180) days after payment of licensure fees. For the complete processing of Form OFR-MIL-001, a loan originator application must be deemed received pursuant to the provisions of section 494.00312(3), F.S.

View Source

September 11, 2018

Illinois Leads MBA Push for Uniform Mortgage Ad Licensing Disclosure Protocols

MBA Newslink--Mike Sorohan

You've heard them on the radio or seen them on TV or print--those seemingly endless "disclaimers" issued at blinding speed by some John Moschitta wannabe at the end of an advertisement (or sometimes at the beginning) pushing important, often-unintelligible legal mumbo-jumbo out of the way:

"This-is-not-a-commitment-to-make-a-loan-which-is-subject-to-borrower-qualifications-including-income-property-evaluation-sufficient-equity-in-the-home-to-meet-LTV-requirements-and-final-credit-approval-subject-to-change-without-notice-based-on-applicant-eligibility-and-market-conditions-terms-of-the-loan-may-be-subject-to-payment-of-points-and-fees-by-the-applicant."

The problem with these disclosures, says William Kooper, Vice President of State Government Affairs and Industry Relations with the Mortgage Bankers Association, is that they're often meaningless to the very people they are intended to protect--the consumer.

"Currently required state licensing disclosures for print and electronic advertising are not achieving their intended objective of informing and protecting consumers because they convey little useful information," Kooper said. "When print, radio or television ads are circulated in multiple states, the preponderance of licensing disclosures render them collectively invisible to consumers. Worse, in radio ads these disclosures require speed reading that is unintelligible and serves no practical purpose."

Most states have now adopted the Conference of State Bank Supervisors/American Association of Residential Mortgage Regulators model law provision (http://www.nmlsconsumeraccess.org/) requiring state-licensed mortgage companies and professionals to exhibit their Nationwide Mortgage Licensing System Unique Identifier in their origination-focused consumer solicitations and advertisements. However, in implementing this standard, numerous state legislatures/regulators have adopted additional disclosure requirements (or retained older disclosure requirements) for their particular licensing information, such as requirement of an in-state business address and/or a statement that the licensee is regulated by a particular state agency and requirement of state-specific license numbers.

"If you are a lender that operates and advertises regionally or nationally, advertisement disclosures can become exceedingly lengthy when accounting for--in aggregate--these state-specific licensing requirements," Kooper said. "Moreover, these disclosures absorb significant portions of costly radio/television airtime and print space. But most importantly, the cumulative effect becomes a laundry list of statements--crammed into a few seconds of airplay or into the 'fine print'--and disclosures that are rendered invisible and likely meaningless to the consumer. In a worst case scenario, these disclosures appear disingenuous."

To alleviate this confusion--and to assure simplicity and uniformity nationwide--MBA has called for states to adopt, through regulatory rulemaking or by legislative action, a uniform advertisement disclosure protocol. Such a protocol, MBA said, would accomplish the following:

--Provide consumers with necessary clarity regarding the state licensing of mortgage companies and professionals; --Streamline the industry's representation of its state licensing statuses; and

--Remove state-specific license disclosure requirements for mortgage company, mortgage loan originator and mortgage broker advertisements.

The MBA proposal can be viewed at http://mba-pc.informz.net/mba-pc/data/images/PolicyDocuments/MBA%20Proposal%20--%20Licensing%20Ad%20Disclosure.pdf.

The MBA proposal says consumers should be directed through a uniform disclosure to NMLS Consumer Access--a comprehensive, state regulator-developed database for verifying the credentials and licensing status of mortgage companies and loan originators with whom they seek to do business. NMLS Unique Identifiers would remain a necessity in all origination-focused consumer solicitations and advertisements from state-licensed mortgage companies and professionals. Depending on the particular advertisement medium or use, lenders would be required to incorporate one of the following phrases:

1) "For licensing information, go to: www.nmlsconsumeraccess.org;" or

2) "www.nmlsconsumeraccess.org."

States would remove their specific licensing disclosure requirements in favor of this uniform protocol.

Last month, Illinois Gov. Bruce Rauner (R) signed SB. 2615 (http://ilga.gov/legislation/BillStatus.asp?DocNum=2615&GAID=14&DocTypeID=SB&LegId=109684&SessionID=91&GA=100), supported by MBA, the Mortgage Action Alliance and the Illinois MBA, to streamline advertising disclosures in the state.

The law was approved unanimously by the state legislature earlier this year, and embraced the MBA initiative to create uniform requirements among states that features the consumer-facing pages of www.NMLSConsumerAccess.org.

Bryan Schneider, Secretary with the Illinois Department of Financial and Professional Regulation, said the language in the MBA proposal was helpful in crafting SB 2615. "We are always looking for ways in which regulations can be more meaningful for consumers," he said. "The 'fast talk' or 'fine print' in these disclosures struck me as ridiculous, and meaningless to consumers."

Schneider said discussions with MBA, as well as "organic" discussions with his staff, led to a Department proposal that became SB 2615. "We introduced this as one of our department initiatives in the latest state assembly," he said. "It enjoyed unanimous support in the State Assembly. And our Attorney General's office, which is often involved in consumer affairs, supported the bill as well. It was gratifying to have so much support from so many parts of the government."

The law is now in effect; Schneider said its benefits are immediate. "Over time, it makes advertising more meaningful," he said. "NMLS is the recognized standard; it will ultimately make information more accessible. The most important information is the NMLS number, which enables any consumer to look up information about the lender and decide if they want to work with them. The law takes a mumbo-jumbo of legal disclaimer that no one pays attention to and creates a system that's less cluttered and more impactful for consumers. It makes sense for consumers; it makes sense for industry, and it make sense for government."

For MBA, the Illinois law now represents a new 50-state effort to adopt uniform standards in mortgage regulation. Earlier this year, MBA closed the book on a nationwide effort to for adoption of the Uniform State Test for mortgage loan originators when Minnesota became the last jurisdiction to adopt the UST; currently, MBA is engaged in a new effort with the American Land Title Association to promote uniform adoption of Remote Online Notarization standards (https://www.mba.org/audience/state-legislative-and-regulatory-resource-center/remote-online-notarization).

Kooper said he is encouraged by the Illinois adoption of ad licensing protocols and hopes to build momentum elsewhere. "The Illinois approach has the potential to be a model for other states to emulate," he said.

View Source
ACES ENGAGE 2025

ACES ENGAGE 2025

ACES ENGAGE 2025 registration now open!

Join us at the Broadmoor in Colorado Springs on May 18-20, 2025.

Reserve Your Seat

September 10, 2018

DE HB353 - Delaware Amends Provisions Regarding Mortgagee Address Change

Summary

Section 1 of this Act clarifies that the intent of Senate Bill No. 32 of the 149th General Assembly was to require mortgagees to file a statement of mortgagee address change when its notice address changed, not to require mortgagees to include each mortgage affected by a change of notice address.

Status: (Passed) 2018-09-04 - Signed by Governor 

Delaware House Bill 353

View Source

September 06, 2018

California Poised to Enact Internet of Things Information Security Law

Ballard Sparh, LLP--David M. Stauss

California is once again poised to set the standard for privacy and data security by enacting the first state law directed at securing Internet of Things (IoT) devices. The law has passed the state legislature and is awaiting the signature of Governor Jerry Brown. It requires manufacturers of "connected devices" to equip them with "a reasonable security feature or features" that are:

  • appropriate to the nature and function of the device;
  • appropriate to the information the device may collect, contain or transmit; and
  • designed to protect the device and any information contained in it from unauthorized access, destruction, use, modification, or disclosure.

The law further provides that if a connected device is equipped with a means for authentication outside a local area network, it shall be deemed a "reasonable security feature" if the preprogrammed password is either unique to each device or the device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time.

The law defines "authentication" as "a method of verifying the authority of a user, process, or device to access resources in an information system." It defines "connected device" as "any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address." "Manufacturer" is defined as "the person who manufactures, or contracts with another person to manufacture on the person’s behalf, connected devices that are sold or offered for sale in California."

Notably, the law exempts certain activities from its requirements. For example, it does not impose a "duty upon the manufacturer of a connected device related to unaffiliated third-party software or applications that a user chooses to add to a connected device." It also does not apply "to any connected device the functionality of which is subject to security requirements under federal law, regulations, or guidance promulgated by a federal agency pursuant to its regulatory enforcement authority." And the law exempts HIPAA covered entities and business associates to the extent the activity in question is covered by that act.

Importantly, the law states that it does not create a private right of action and vests enforcement authority solely with the California Attorney General’s Office, a city attorney, a county counsel, or a district attorney.

California law also already requires businesses to notify affected individuals if the business experiences a data breach and allows for a private right of action. The newly enacted California Consumer Privacy Act of 2018 also provides for not only a private right of action for certain data breaches, but also for statutory damages of between $100 and $750 per consumer per incident. Therefore, the new law fits into a broader statutory landscape that IoT manufacturers should be aware of and should take steps to mitigate the risk of litigation. That is particularly true given that plaintiffs' lawyers have publicly stated that they are preparing for an onslaught of IoT-related litigation.

The Senate Floor Analysis explained that the law is necessary because many IoT devices "collect a vast amount of personal and intimate information" which, if not properly secured, can be vulnerable to breaches. Further, many IoT devices "can be directly hacked into, allowing strangers to conduct surreptitious surveillance on homes or to communicate through devices directly."

The law was enacted contemporaneously in both the California Senateand Assembly. It takes effect on January 1, 2020.

Members of Ballard Spahr's Privacy and Data Security Group provide a full range of counseling, transactional, regulatory, investigative, and litigation services across industry sectors and help clients around the world identify, manage, and mitigate cyber risk. Our team of nearly 50 lawyers across the country includes investigators and advocates with deep experience in cyber-related internal and governmental investigations, regulatory compliance and enforcement matters, cyber-related crisis management, and civil and criminal litigation.

View Source

September 06, 2018

California Modifies Provisions Regarding Debt Collection

California Assembly Bill 1526 amends Section 1788.14 of the Civil Code, and amends Section 337 of the Code of Civil Procedure, relating to debt collection.  

The Rosenthal Fair Debt Collection Practices Act regulates the practice of debt collection and the conduct of debt collectors, as defined. The act prohibits specified conduct by a debt collector in connection with the collection or attempted collection of a consumer debt. The act provides for enforcement by means of civil penalties and damages, as specified.

This bill would prohibit a debt collector from sending a written communication to a debtor attempting to collect a time-barred debt without providing specified written notices stating that the debtor may not be sued for the debt, but that the debt, depending on its age, may be reported as unpaid to credit reporting agencies, as specified.

Existing law prescribes periods for commencement of various actions. Among others, an action must be commenced within 4 years if the action is to recover (1) upon a book account whether consisting of one or more entries; (2) upon an account stated based upon an account in writing, but the acknowledgment of the account stated need not be in writing; or (3) a balance due upon a mutual, open and current account, the items of which are in writing. Existing law provides, however, that where an account stated is based upon an account of one item, the time shall begin to run from the date of the item, and where an account stated is based upon an account of more than one item, the time shall begin to run from the date of the last item.

This bill would specify that when the 4-year period in which an action must be commenced has run, no person may bring suit or initiate an arbitration or other legal proceeding to collect the debt. This bill would provide that the period may be extended only in specified circumstances.

These provisions are effective on January 1, 2019.

View Source

August 29, 2018

Vermont Adopts Provisions Regarding Residential Real Estate Mortgage Loan Commitment Letters

The Vermont Department of Financial Regulation Banking Division adopts Regulation B-2018-02 (Supersedes and Replaces Regulation B-98-1), regarding the form, content and timing of residential real estate mortgage loan commitment letters. 

Section 1. Authority, Scope and Purpose

This regulation is promulgated pursuant to Title 9 V.S.A. §103, and applies to every mortgage loan, as hereinafter defined. Title 9 V.S.A. §§103 (a) and (b) require that lenders issue commitment letters in connection with residential mortgage loans.  Title 9 V.S.A. §103(c) grants the Commissioner the authority to promulgate rules specifying the form, content, and timing of commitment letters required by §§103 (a) and (b). The purposes of this regulation are to create the minimum framework within which commitment letters are to be issued in this state and to encourage complete and timely disclosure of information in the furtherance of consumer protection.

Section 6. Effective Date

This regulation is effective October 1, 2018. Lenders shall be in compliance with the provisions of this regulation commencing 90 days from the effective date hereof.  (During the 90-day transition period, a lender may comply with either this regulation or prior Regulation B-98-1.)  The commissioner may waive compliance with this regulation for a lender for additional 30 days, not to exceed 120 days from adoption, for good cause shown.

[Please read the final rule for complete details]

View Source
Learn Why Clients Love ACES

Learn Why Clients Love ACES

"We are already ahead of the game and without having to add additional FTEs."

- Julie Baril, QC Manager at Norcom Mortgage

Hear Why

August 29, 2018

New Jersey Amends Licensing Provisions under RMLA

New Jersey Assembly Bill 2035 revises the New Jersey Residential Mortgage Lending Act to add definitions, new MLO licensing requirements for individual contractors, addresses requirements for exempted companies, specifies that each branch office be under the supervision of a branch manager, who will supervise only one branch office at any given time, and modifies permissible fees charged by a residential mortgage lender, incidental to the origination, processing and closing of any mortgage loan transaction.

These provisions are effective on November 22, 2018.

View Source

August 23, 2018

Ohio Establishes Cybersecurity Program Affirmative Defense

Compliance Monitor--Robert Harrison

Through Ohio Senate Bill 220 (the “Act”), the State has established an affirmative defense to a tort action brought against a covered entity because of a data breach. The Act defines “covered entity” to mean “a business that accesses, maintains, communicates, or processes personal information or restricted information in or through one or more systems, networks, or services located in or outside this state.” (Ohio Revised Code §1354.01(B))  In order to meet the requirements for the affirmative defense, a covered entity must have a compliant written cybersecurity program that contains certain safeguards. (O.R.C. §1354.02)  The cybersecurity program may protect just personal information or both personal and restricted information.  If the program is only designed to protect personal information, then the affirmative defense may be used to defend against a tort action alleging that the failure to implement reasonable information security controls resulted in a data breach concerning personal information. (O.R.C §1354.02(A) and (D)).   The Act sets requirements for cybersecurity programs and identifies approved cybersecurity frameworks with which covered entities must reasonably conform with:

  • The Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology (NIST);
  • NIST Special Publication 800-171;
  • NIST Special Publications 800-53 and 800-53a;
  • The Federal Risk and Authorization Management Program Security Assessment Framework;
  • The Center for Internet Security Critical Security Controls for Effective Cyber Defense;
  • The International Organization for Standardization/International Electrotechnical Commission 27000 Family – Information Security Management Systems. (O.R.C. §1354.03(A))

If the covered entity is regulated by the State, the federal government, or both, or is otherwise subject to the requirements of any of the laws or regulations listed below, the entity meets the cybersecurity program requirements if the program conforms to:

  • The security requirements of the federal Health Insurance Portability and Accountability Act of 1996 , which governs healthcare;
  • Title V of the federal Gramm-Leach-Bliley Act of 1999, which applies to financial institutions;
  • The Federal Information Security Modernization Act of 2014, which generally covers federal agencies;
  • The Health Information Technology for Economic and Clinical Health Act, which applies to healthcare providers. ((O.R.C. §1354.03(B))

Blockchain

Definitions for “electronic record and “electronic signature” have been amended to include blockchain technology; “a record or contract that is secured through blockchain technology is considered to be in an electronic form and to be an electronic record.” (O.R.C. §1306.01(G)) and “[a] signature that is secured through blockchain technology is considered to be in an electronic form and to be an electronic signature.” (O.R.C. §1306.01(H))

The full legislation text can be found here: https://www.legislature.ohio.gov/legislation/legislation-summary?id=GA132-SB-220

View Source

August 22, 2018

Update on California’s Consumer Privacy Act of 2018

Ballard Sparh, LLP--David M. Stauss & Philip N. Yannella 

As discussed in our prior post, the California Consumer Privacy Act of 2018 (the “Act”) is expected to be modified by the California legislature prior to its January 1, 2020, enforcement deadline. In fact, while Governor Brown signed the legislation less than two months ago, one effort to amend the law already is underway through California Senate Bill 1121.

However, those hoping for large scale changes to the law may have to wait. According to the Assembly Bill Analysis (available here), Senate Bill 1121 only is intended to “make a variety of technical, clarifying, and non-substantive changes to correct drafting errors in the new law.”  The examples of such “drafting errors” given by the Bill Analysis are:

  • Clarifying that the private right of action is limited to the data breach provision of the Act;
  • Replacing the term “verified request” with “verified consumer request” throughout the Act to accurately reflect the definitions contained therein;
  • Correcting the plural possessive use of “business” throughout the Act;
  • Reorganizing certain paragraphs to ensure clarity;
  • Striking duplicative sentences; and
  • Clarifying that the rights and obligations in the Act shall not be construed to infringe on First Amendment-protected newsgathering activities.

While many of the changes are, in fact, just technical fixes, the proposed change to the private right of action could be significant for businesses subject to the Act. In our prior webinar on the Act, we discussed how plaintiffs’ lawyers could plausibly argue that the current private right of action language is broad enough to enforce the privacy rights provided under the Act.

Senate Bill 1121 would attempt to address that by adding limiting language to the private right of action, providing that “[t]he civil action established in this section shall apply only to violations of subdivision (a).”  Subdivision (a) of Section 1798.150 now states:

Any consumer whose nonencrypted or nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:
(A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater.
(B) Injunctive or declaratory relief.
(C) Any other relief the court deems proper.

Frankly, it is arguable whether Senate Bill 1121’s proposed language is the best method to limit the private right of action to just data breaches. A better (or additional) fix would be to undo the last minute change to this section by deleting “an unauthorized access and exfiltration, theft, or disclosure” and replacing it with “a security breach of the business as described in Section 1798.82.”

In any event, at a minimum, having the Assembly Bill Analysis state that the proposed change is intended to limit the private cause of action to the data breach provision of the Act is certainly welcome news for businesses subject to the Act.

Finally, while Senate Bill 1121’s stated purpose is only to address non-substantive issues, both privacy and business advocacy groups have used the bill as an opportunity to publicly state their positions on how the Act should (or should not) be amended.

In the end, at least one thing appears certain – there is going to be a lot more to come on the Act before the January 2020 enforcement deadline.

View Source

August 20, 2018

Significant changes to Connecticut consumer finance licensing laws to take effect October 1, 2018

Ballard Sparh, LLP--John D. Socknat

Significant changes to Connecticut’s licensing laws for consumer financial services providers will take effect on October 1, 2018.  In addition to changes impacting mortgage-related licensees (e.g. mortgage lenders, originators and brokers), Public Act 18-173 revises or creates new licensing requirements for many providers including small loan lenders, sales finance companies, money transmitters, check cashers, debt adjustors, debt negotiators, collection agencies, student loan servicers, and mortgage servicers.

New requirements include requirements (1) for licensees to clearly display their unique identifier, including on internet websites and in all audio solicitations, and (2) for licensees to conduct activities subject to licensure from a U.S. office.

Of particular note is a new requirement (which appears to be unprecedented), for sales finance companies to acquire and maintain information about the ethnicity, race, and sex of applicants for motor vehicle retail installment contracts.  A licensee will be required to submit the demographic records collected between October 1, 2018 and June 30, 2019 to the Connecticut Banking Department by July 1, 2019.

We understand that representatives of the Banking Department will be meeting with an industry group this week to discuss the Equal Credit Opportunity Act issues presented by this requirement and that the Department hopes to provide guidance soon.  (The new requirement presents an apparent conflict with the Regulation B proscription against a non-mortgage creditor inquiring about the race, ethnicity or gender of an applicant.   See 12 C.F.R. § 1002.5(b) (“A creditor shall not inquire about the race, color, religion, national origin, or sex of an applicant or any other person in connection with a credit transaction, except as provided in paragraphs (b)(1) [relating to self-testing that complies with Sections 1002.15 of Regulation B] and (b)(2) of this section [authorizing only an optional request to designate a title on an application form such as Ms., Miss, Mr. or Mrs.])

For more information on the provisions of Public Act 18-173, click here.

View Source

Stay Informed, Subscribe to the Compliance Newshub