Cal. FIN § 90008

(a) The department shall, by rule, establish reasonable procedures to provide a timely response to consumers, in writing where appropriate, to complaints against, or inquiries concerning, a covered person.

(b) The department shall, by rule, require a covered person to provide a timely response, in writing where appropriate, to the department concerning a consumer complaint or inquiry, including all of the following:

(1) Steps that have been taken by the covered person to respond to the complaint or inquiry of the consumer.

(2) Responses received by the covered person from the consumer.

(3) Follow-up actions or planned follow-up actions by the covered person to respond to the complaint or inquiry of the consumer.

(c) Subdivisions (a) and (b) shall not apply to a covered person to the extent it is a consumer reporting agency, as defined by the Fair Credit Reporting Act (15 U.S.C. Sec. 1681a(f)).

(d) With respect to the provision of information to consumers by covered persons, all of the following shall apply:

(1) A covered person shall, in a timely manner, comply with a consumer request for information in the control or possession of that covered person concerning the consumer financial product or service that the consumer obtained from that covered person, including supporting written documentation, concerning the account of the consumer.

(2) Notwithstanding paragraph (1), a covered person may not be required by this section to make available to the consumer any of the following information:

(A) Confidential commercial information, including an algorithm used to derive credit scores or other risk scores or predictors.

(B) Information collected by the covered person for the purpose of preventing fraud or money laundering, or detecting or making any report regarding other unlawful or potentially unlawful conduct.

(C) Information required to be kept confidential by any other provision of law.

(D) Nonpublic or confidential information, including confidential supervisory information.

(E) Information collected, received, maintained, disclosed, sold, or processed pursuant to the Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.), but only to the extent subdivision (b) is inconsistent with any provision of the Fair Credit Reporting Act, and then only to the extent of the inconsistency, or to the extent that subdivision (b) imposes a requirement that is otherwise prohibited under Section 1681t(b) of Title 15 of the United States Code.

(3) This subdivision shall not apply to a consumer credit reporting agency subject to Section 1785.10 of the Civil Code.

(e) The department shall promulgate regulations to implement subdivisions (a) and (b) before commencing an enforcement action against a covered person or service provider for a violation of those provisions.