If You Are A Consumer Reporting Agency
This section is a summary of the restrictions and requirements imposed on consumer reporting agencies. Our assumption is that most readers are not consumer reporting agencies and, therefore, our descriptions are brief. For further details on any of these topics, see the FCRA provisions cited below or the Commentary on the FCRA published by the Federal Trade Commission (16 CFR § 600, Appendix).
The Circumstances Under Which a Consumer Reporting Agency may Furnish a Consumer Report
- Pursuant to a court order or federal grand jury subpoena. [15 USC 1681b(a)(1)]
- According to written instructions of the consumer to whom the report relates. [15 USC 1681b(a)(2)] According to an Advisory Letter from FTC staff, the requirement that the instructions be written is satisfied if the consent is faxed, but is not satisfied if the consumer merely clicks “yes” on a web site. See the Advisory Letter from Christopher W. Keller of the FTC dated October 12, 1999. Also see the Informal Staff Opinion that addresses this issue in the context of the Electronic Signatures in Global and National Commerce Act (“E-SIGN Act”), which became law after the Keller letter. According to the Informal Opinion, the E-SIGN Act does provide that a consumer’s instructions are not invalid solely because they are in electronic form. [15 USC 7001(a)] But the E-SIGN Act also provides that the instructions may be invalid if those instructions are not “capable of being retained and accurately reproduced for later reference by all parties…” [15 USC 7001(e)] The Informal Opinion states that whether this is the case is a question that must be decided on a case by case basis. [Federal Trade Commission, Advisory to Walter Zalensky, May 24, 2001]
- When the consumer reporting agency has reason to believe the person to whom the report is being given intends to use it “in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer.” [15 USC 1681b(a)(3)(A)] The FTC, in an Informal Staff Letter, has interpreted this as not authorizing the obtaining of a consumer report on an individual when the individual is the owner of a business that is applying for business credit, even if the individual is guaranteeing the credit. The rationale is that it is the business, and not the individual, to whom the credit is being granted. See the Informal Staff Letter from the FTC’s David Medine to Charles Tatelbaum, dated July 26, 2000, available at www.ftc.gov. A later Informal Staff Opinion, however, supersedes this opinion in a certain respect. The later opinion states that “…it is reasonable to view a business transaction in which an individual has accepted personal liability for the business debt as involving the consumer, thus providing a permissible purpose for the lender to obtain a consumer report under Section 604(a)(3)(A).” [See the Informal Staff Letter from the FTC’s Joel Winston to Banking Agency Counsels, dated June 22, 2001.] The later opinion does not, however, supersede the earlier with respect to other issues, such as whether merely being the owner, director, or officer, without being obligated personally on the credit, is a permissible purpose under this paragraph. The earlier opinion had ruled that such a case does not present a permissible purpose. • When the consumer reporting agency has reason to believe the person to whom the report is being given intends to use it for employment purposes. [15 USC 1681b(a)(3)(B)]
- When the consumer reporting agency has reason to believe the person to whom the report is being given intends to use it “in connection with the underwriting of insurance involving the consumer.” [15 USC 1681b(a)(3)(C)]
- When the consumer reporting agency has reason to believe the person to whom the report is being given intends to use it “in connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility.” [15 USC 1681b(a)(3)(D)]
- When the consumer reporting agency has reason to believe the person to whom the report is being given intends to use it in the role of an investor in or servicer or insurer of an existing credit obligation. [15 USC 1681b(a)(3)(E)]
- When the consumer reporting agency has reason to believe the person to whom the report is being given has a legitimate business need for the information in connection with a business transaction initiated by the consumer or to review an account to see whether the consumer continues to be eligible for an account. [15 USC 1681b(a)(3)(F)] The FTC, in an Informal Staff Letter, has interpreted this as not authorizing the obtaining of a consumer report on an individual when the individual is the owner of a business that is applying for business credit, even if the individual is guaranteeing the credit. The rationale is that it is the business, not the consumer, who is initiating the transaction. See the Informal Staff Letter from the FTC’s David Medine to Charles Tatelbaum, dated July 26, 2000, available at www.ftc.gov. Recall that the Tatelbaum letter also concluded that these circumstances did not meet the requirements for an earlier permissible purpose, the third bullet in this list. A subsequent Informal Staff Letter superseded the Tatelbaum letter with respect to that permissible purpose. The subsequent letter did not supersede the Tatelbaum conclusion here, that this circumstance was not a permissible purpose, even if the individual was assuming personal liability on the credit. [See the Informal Staff Letter from Joel Winston to counsels for the federal banking agencies, dated June 22, 2001.]
- When requested by certain government agencies in connection with child support orders. [15 USC 1681b(a)(4) and (5)]
In spite of these limitations, a consumer reporting agency may furnish certain information to governmental agencies. The information must be limited to a consumer’s name, address, former addresses, places of employment, or former places of employment. [15 USC 1681f]
Some procedural rules apply if the person to whom the report is given intends to use it for employment purposes, the fourth bullet above. First, the person must certify to the consumer reporting agency that the person has and will comply with certain consumer disclosure requirements and that the report will not be used in violation of any federal or state equal employment opportunity law or regulation. [15 USC 1681b(b)(1)(A)] Second, the consumer reporting agency must provide, along with the report, a summary of the consumer’s rights under Section 1681g of the FCRA. [15 USC 1681b(b)(1)(B)] Third, the person obtaining the report, in addition to certifying that it provided consumer disclosures, must actually provide the consumer with the disclosures and obtain written permission from the consumer to obtain the report. [15 USC 1681b(b)(2)] Finally, if the person obtaining the report intends to take adverse action based in whole or in part on the report, that person must provide to the consumer a copy of the report and a summary of the consumer’s rights under the FCRA. [15 USC 1681b(b)(3)] (This last requirement does not apply if the person obtaining the report is a federal agency and it determines that certain conditions are met. [15 USC 1681b(b)(4)])
The Requirement that “Obsolete” Information not be Reported
- Bankruptcy cases where date of entry for the order for relief or the date of adjudication precede the report by more than ten years. [15 USC 1681c(a)(1)]
- Suits and judgments where the date of entry precede the report by more than seven years or until the governing statute of limitations has expired, whichever is the longer period. [15 USC 1681c(a)(2)]
- Tax liens that have been paid off, if the date of payment precedes the report by more than seven years. [15 USC 1681c(a)(3)]
- Accounts which, for more than seven years preceding the date of the report, have been placed for collection or charged to profit and loss. [15 USC 1681c(a)(4)]
- Records of arrest, indictment, or convictions of crime which are more than seven years old, counting from the date of disposition, release, or parole. [15 USC 1681c(a)(5)]
- Any other adverse information more than seven years old. [15 USC 1681c(a)(6)]
These restrictions do not apply, however, in certain circumstances where large-dollar transactions are at issue. [15 USC 1681c(b)] For example, if the report is issued in connection with a credit transaction of $150,000 or more, the report may contain information listed above.
The Requirement that Certain Information be Included
If the consumer report mentions a bankruptcy case involving the consumer, it must also mention the particular chapter of the Bankruptcy Code under which the case proceeded. [15 USC 1681c(d)] Also, a consumer report must disclose that an account has been voluntarily closed by the consumer if that is the case. [15 USC 1681c(e)] Finally, information which is disputed by the consumer must be so labeled in a consumer report. [15 USC 1681c(f)]
Compliance Procedures
Consumer reporting agencies must have procedures to help ensure that the objectives of the FCRA are met. For example, they must have procedures designed to avoid issuing reports with obsolete information listed above. They must also have procedures designed to avoid issuing reports for other than permitted purposes. Agencies must attempt to verify the identity of users of consumer reports and must have users certify the uses to which they will put reports. Finally, agencies must have procedures to “assure maximum possible accuracy” of the information included in reports. [15 USC 1681e]
The FCRA imposes two other compliance-type requirements on consumer reporting agencies that are designed to make the Act more effective. First, consumer reporting agencies may not prohibit users of reports from showing the report to a consumer if the user took adverse action against the consumer based on the report. [15 USC 1681e(c)] Second, consumer reporting agencies must supply users of reports who also supply information to the agency with a disclosure which describes the responsibilities of such a person. [15 USC 1681e(d)]
The FCRA also imposes compliance procedure requirements on persons who purchase consumer reports for the purpose of reselling them. [15 USC 1681e(e)] First, the person purchasing the report for resale must disclose to the consumer reporting agency the identity of the end user and the permissible purpose to which the end user will put the report. [15 USC 1681e(e)(1)] Second, the reseller must have procedures in place to ensure that the report is sold only to someone with a permissible purpose, or, if the report is sold to another reseller, that that reseller identify the end user and certifies that the end user’s purpose for obtaining the report is permissible. The reseller must make a reasonable effort to verify the information certified. [15 USC 1681e(e)(2)] If the end user is an agency or department of the federal government and certain conditions are met, the reseller need not identify the end user. [15 USC 1681e(e)(3)]
The Requirement that Consumer Reporting Agencies Disclose their Files to Consumers and the Conditions on that Requirement
If a consumer requests it and meets certain conditions, a consumer reporting agency must disclose to the consumer certain information about the consumer’s file. In particular, the agency must disclose the nature and substance of information about the consumer (except medical information). The agency must also disclose (with some exceptions) the sources of the information. Finally, the agency must disclose the recipients of consumer reports on the consumer that the agency has issued in the recent past. (The exception to this rule is that the Federal Bureau of Investigation [FBI] is permitted to access consumer reports in connection with an investigation of issues, such as counterintelligence, and such an inquiry is not recorded and cannot be disclosed to the consumer. [15 USC 1681u] The agency must provide trained personnel to explain to the consumer the information provided by the agency. The agency must also provide a disclosure that summarizes the rights of the consumer under the FCRA. [15 USC 1681g and h])
How Consumers can Correct Information
If a consumer disputes the accuracy of information in an agency’s file, the agency must reinvestigate, record the current status of the information, and correct or delete it if and as appropriate. If the consumer still disputes the information, the consumer may file a brief statement about the dispute, and the consumer reporting agency must note in subsequent reports containing the information that the consumer disputes it. The agency, upon request from the consumer, must also notify recent recipients of consumer reports on the consumer of any corrections, deletions, and disputes resulting from the agency’s reinvestigation. [15 USC 1681i]
Charging the Consumer
Consumer reporting agencies must supply one credit report per year free of charge to a consumer on request. [15 USC 1681j(a)] In addition, if the consumer requests information within 60 days of receiving an adverse action notice from a creditor in which the creditor notified the consumer that a consumer report contributed to the adverse action, the consumer reporting agency must provide the information without charge to the consumer. [15 USC 1681j(b)] There are other exceptions as well. [15 USC 1681j]
Use of “Public Record Information”
If an agency issues a report for employment purposes and the report includes information that is a matter of public record and is likely to have an adverse effect on the consumer’s ability to obtain employment, the agency must either: (1) send a notice to the consumer [the notice must state the fact that public record information is being reported and the name and address of the recipient], or (2) have procedures to ensure that the public record information is complete and up to date. [15 USC 1681k]
Information on Overdue Child Support Payments
Regardless of any other provisions in the FCRA, credit reporting agencies must include in consumer reports furnished in accordance with Section 1681b any information on the failure of the consumer to pay overdue support, which is provided to the consumer reporting agency by a state or local child support enforcement agency or to the consumer reporting agency and verified by any local, state, or federal government agency and which antedates the report by seven years or less. [15 USC 1681s-1]
Mandatory Release of Information Regarding International Terrorism
A consumer reporting agency must release a consumer report and any other information relating to a consumer when certain government agencies provide a sufficient certification. The government agencies are those authorized to conduct investigations of, or intelligence or counterintelligence activities or analysis related to, international terrorism. The agency must certify that such information is necessary for the agency’s conduct or such investigation, activity, or analysis. [15 USC 1681v(a)] The certification must be signed by a supervisory official designated by the head of a federal agency or an officer of a federal agency whose appointment to office is required to be made by the President, by and with the advice and consent of the Senate. [15 USC 1681v(b)] The release of the information is confidential. [15 USC 1681v(c)]
Miscellaneous FACT Act Provisions
President Bush signed the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) into law on December 4, 2003. The FACT Act significantly amends the Fair Credit Reporting Act. Most of the amendments that would be important to readers of this manual went into effect December 1, 2004. The FACT Act mandated that a number of federal agencies issue implementing regulations. At the time of this writing (October 2005), the agencies had issued some, but not all, of the regulations.
A consumer reporting agency must include in a consumer report a notation to the effect that a key factor that adversely affected the credit score in the report was the number of enquiries, if that was the case. This, obviously, applies only if the credit report contains a credit score or any other risk score or predictor. [15 USC 1681c(d)(2)]
The consumer reporting agency must notify a person requesting a consumer report of any significant difference between the address of the subject of the report as it appears in the request and as it appears in the files of the consumer reporting agency. [15 USC 1681c(h)]
A nationwide consumer reporting agency must include a “fraud alert” in the consumer’s file along with any credit score if the consumer asserts in good faith that he or she has been or is about to become a victim of fraud or related crime, including identity theft. The consumer reporting agency must include the alert for 90 days after the request, unless the consumer requests that it be removed sooner. The consumer reporting agency must also notify the other nationwide consumer reporting agencies of the fraud alert, and must disclose to the consumer the right to receive a free copy of the file. [15 USC 1681c-1(a)]
If a consumer provides an “identity theft report” to a nationwide consumer reporting agency, the agency must include a fraud alert in the file along with any credit score for seven years after the request. For five years, the agency must exclude the consumer’s name from any lists the agency prepares for a third party to offer credit or insurance to the consumer for a transaction not initiated by the consumer. The agency must also notify the other nationwide consumer reporting agencies of the extended fraud alert, and must disclose to the consumer the right to receive two free copies of the file. [15 USC 1681c-1(b)]
A nationwide consumer reporting agency must include, upon request from an active duty military consumer, an “active duty alert” in the file along with a credit score. The agency must continue this for at least 12 months, and must exclude the consumer’s name from lists (prepared for a third party to offer credit or insurance to the consumer for a transaction not initiated by the consumer) for two years. The agency must also notify other nationwide agencies about the active duty alert. [15 USC 1681c-1(c)]
Nationwide consumer reporting agencies that receive notice of a fraud alert or an active duty alert from another consumer reporting agency must respond as if they had received a request for the alert from the consumer. [15 USC 1681c-1(e)]
Credit reporting agencies must supply the consumer’s credit score when the consumer requests it, and must also provide certain explanatory information along with the score. [15 USC 1681g(f)]
The requirement to reinvestigate disputed information applies in only a limited way to “resellers,” a new category of consumer reporting agency. A reseller is a consumer reporting agency that assembles and merges information from other agencies but does not maintain a database of the assembled or merged information. The reinvestigation rules require a reseller, upon notice of disputed information, to investigate and determine whether the incorrect information is a result of an act or omission of the reseller. If so, the reseller must promptly correct the problem. If not, the reseller must pass along the notice of dispute to the consumer reporting agencies from which the information came. [15 USC 1681i(f)]
A consumer reporting agency must block from its report any information that results from an alleged identity theft, if certain conditions are met. The agency must also notify the person who furnished the blocked information that the information may be the result of identity theft and provide details. Under certain circumstances, the agency is allowed to decline a request to block information and to rescind a blocking already in existence. The Act provides exceptions to these rules for agencies that are resellers of consumer information, and consumer reporting agencies are not prevented by this rule from providing information to law enforcement authorities. [15 USC 1681c-2]
When consumer reporting agencies provide disclosures to the consumer as required under the FCRA, they must also provide a summary of the consumer’s rights under the FCRA, along with some other information intended to help the consumer enforce those rights. Model language for the summary is to be created by the Federal Trade Commission. [15 USC 1681g(c)] The FTC is also directed to create a summary of rights for consumers who are victims of identity theft, and consumer reporting agencies are required to provide the summary to consumers under certain conditions. [15 USC 1681g(d)]
What we have just reviewed are the requirements and restrictions the FCRA imposes on consumer reporting agencies.