Liability

The FCRA provides for administrative, civil, and criminal liability for violations of its provisions.

Administrative liability means liability toward an administrative agency. An agency with administrative authority has the power to issue cease-and-desist orders and has other procedural powers to ensure the enforcement of the FCRA. Banks, savings associations, and credit unions face administrative liability toward the usual federal financial institution regulatory agencies—the Federal Reserve Board (state member banks), the Office of the Comptroller of the Currency (national banks and savings associations), the Federal Deposit Insurance Corporation (state nonmember banks), and the National Credit Union Administration (federal credit unions only—state credit unions are apparently subject to FTC enforcement). [15 USC 1681s(a) and (b)]

Civil liability means liability to the person or persons harmed by the violation. If a person (whether a consumer reporting agency or a user) willfully violates the FCRA, that person can be liable to the harmed consumer for actual damages, punitive damages, and the costs of the action and reasonable attorneys’ fees. [15 USC 1681n(a)] Anyone who obtains a consumer report under false pretenses or knowingly without a permissible purpose is liable to the consumer reporting agency for actual damages or $1,000, whichever is greater. [15 USC 1681n(b)] If a person negligently violates the FCRA, that person can be liable to the harmed consumer for actual damages and the costs of the action and reasonable attorneys’ fees. [15 USC 1681o] Punitive damages are not available if the person did not willfully violate the FCRA.

Finally, users can be criminally liable. Any person who “knowing and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under Title 18 of the U.S. Code or imprisoned not more than two years, or both.” [15 USC 1681q] Recall that the FCRA did not directly limit the purposes to which a user could request and obtain a consumer report. The law does, however, require that consumer agencies obtain a certification from potential users as to the use to which the report will be put. Should a user willfully certify a permitted purpose while having some other purpose in mind, the user could be criminally liable under this provision.