Introduction: Fair Credit Reporting Act

The Fair Credit Reporting Act (FCRA) protects the interests of persons about whom information is collected and distributed by consumer reporting agencies. The information usually has to do with the individual’s credit history, character, and so on, and is used by customers of the consumer reporting agency to decide whether to do things such as lend to the individual, hire the individual, sell insurance to the individual, or open a deposit account for the individual.

Since consumer reporting agencies are run by human beings, there is a risk that information collected and distributed by the agency about an individual will be incorrect or so out of date as to no longer be relevant to any legitimate inquiry. There is also a risk that the agency will give the information to persons with no legitimate interest in having it. To put it another way, the very existence of consumer reporting agencies represents some very real risks to the reputations and privacy of individuals about whom the agencies maintain information.

For example, consumer reporting agencies are required to have procedures “to assure maximum possible accuracy” of their information. Furthermore, consumer reporting agencies are required (if certain conditions are met) to disclose to an individual the nature and substance of the information they have relating to the individual (as well as the sources of that information) and persons to whom reports on the individual have been given in the recent past. The FCRA has procedures the individual can then follow to have incorrect information corrected.

Users of consumer reports must certify the purposes for which they seek the information. The FCRA allows access for only certain specified purposes. Users are also required to send an adverse action notice to a consumer when the adverse action is based on a consumer report. The notice must, among other things, identify the consumer reporting agency. With this information, the consumer can check with the agency to make sure the information in the report is correct.

Finally, persons who provide information to consumer reporting agencies must promptly investigate disputed information and correct inaccurate information they have supplied to a consumer reporting agency.

The term “consumer reporting agency” is precisely defined in the FCRA. Most financial institutions do not fit within the definition and will not, therefore, be subject to the requirements and restrictions the FCRA imposes on such agencies. Some financial institutions do fit within the definition, however, and so this section will review the definition at length. After that, the section will give a brief summary of the requirements and restrictions imposed on consumer reporting agencies.

Most financial institutions are, however, users of reports from consumer reporting agencies. Users need to be familiar with what the FCRA has to say about them and this text will look at that in detail. We will look first at the limits on what a user can do with a consumer report. Next, we will define “investigative” consumer reports and describe the additional duties imposed on users who request one of these. Third, we will examine the requirement that the user disclose to the individual that a report on the individual contributed to adverse action on the individual’s credit or deposit account or application. Fourth, we will look at a Federal Financial Institutions Examination Council (FFIEC) Advisory Opinion on how users should respond to consumer reports that are missing important information. Fifth, we will look at the procedures an institution must have to respond to a notice from a consumer reporting agency that there is a discrepancy between the consumer’s address as it appears in the agency’s files and as it appears on a request for a consumer report. Sixth, we will review the requirement that your institution have a program for fighting identity theft.

Many financial institutions are also providers of information to consumer reporting agencies. This section will review their obligation to investigate disputed information and correct inaccurate or incomplete information that they have supplied to consumer reporting agencies.

The section will next review the details of the FACT Act amendments and implementing regulations having to do with the use of information from affiliates for marketing purposes.

The section will next look at liability for violations of the FCRA. Finally, the section will take a brief look at the interplay of state law and the FCRA and then the effect of federal privacy law on the FCRA.

Note that from time to time in the discussion that follows, we will refer to the “FTC Commentary.” The Commentary is a publication of the Federal Trade Commission (FTC), which shares enforcement authority under the FCRA with a number of other agencies. This Commentary is different from Commentaries associated with other statutes or regulations with which you might be familiar, such as Regulation Z (Truth in Lending). These other Commentaries are authorized by their particular statutes and actually have the force of law—that is, institutions which rely on these Commentaries and act in accordance with them are assured of being in compliance with the statute or regulation. The FTC Commentary, on the other hand, is not authorized by the FCRA and does not, therefore, have the force of law. Reliance on it does not assure compliance with the FCRA. The FTC Commentary does, however, reflect the way in which the FTC interprets the FCRA, and it is certainly a thoughtful and helpful guide to understanding the provisions of the FCRA. The Commentary can be found at 16 CFR § 600, Appendix.

You should also be aware that in November of 1999, Congress gave authority to the various financial institution regulatory agencies to issue implementing regulations under the FCRA. In Section 506 of the Gramm-Leach-Bliley Act of 1999, Congress directed the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (FRB), the Federal Deposit Insurance Corporation (FDIC), and the Office of Thrift Supervision (OTS--no longer in existence) to jointly issue regulations that would apply, respectively, to national banks, state member banks, state nonmember banks, and federally insured savings associations. [15 USC 1681s(e)(1)] The Act also gave the FRB authority to prescribe implementing regulations applicable to bank holding companies and affiliates. [15 USC 1681s(e)(1)] Finally, the Act gave authority to the National Credit Union Administration (NCUA) to issue implementing regulations applicable to federal credit unions. [15 USC 1681s(e)(2)] At the time of this writing, the agencies had not issued any final regulations under this authority.

Now we are ready to examine the definition of “consumer reporting agency” so you can determine whether your institution is subject to the requirements and restrictions the FCRA imposes on them.